Sonatype Nexus Security Advisory
Date: August 7, 2026
Affected Versions: Sonatype Nexus Repository 3 CE/Pro versions 3.91.0 through 3.94.x
Fixed in Version: Sonatype Nexus Repository 3 CE/Pro version 3.95.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N = 5.3 (Medium)
CWE: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-17598
Summary
Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one.
Recommendation
Upgrade to Sonatype Nexus Repository 3 CE/Pro version 3.95.0 or later. Downloads are available at https://help.sonatype.com/en/download.html
Immediate Mitigation Options
Restrict the ability to create or update scheduled tasks (the nexus:tasks:create permission) to trusted administrators only, until the upgrade can be applied.
Credit
This issue was discovered and reported responsibly by Mayur Udiniya aka “roughwire” https://x.com/roughwire/ via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An attacker with permission to create at least one scheduled task type could overwrite the configuration of a different, existing scheduled task - for example, redirecting a cleanup or notification task to different targets, or altering its schedule - without permission to manage that task directly.
Q: What preconditions must be met in order to be vulnerable?
A: The attacker must hold an account with the nexus:tasks:create permission for at least one exposed task type.
Q: Are there implications associated with this advisory itself?
A: As with any public vulnerability disclosure, publishing details of this issue could help a bad actor construct an exploit against systems that have not yet been updated. Sonatype recommends assessing your exposure and applying the fix promptly.
Q: Why is Sonatype making this information available?
A: Sonatype follows a responsible disclosure process and proactively notifies customers of security issues so they can take appropriate action to protect their systems.