Sonatype Nexus Security Advisory
Date: August 7, 2026
Affected Versions: All previous Nexus Repository 3 CE/Pro versions from 3.17.0 up to and including 3.94.x
Fixed in Version: Nexus Repository 3 CE/Pro version 3.95.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N = 6.9 (Medium)
CWE: CWE-620: Unverified Password Change
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-17599
Summary
Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result, an account holding the nexus:* permission could invoke the endpoint outside the intended onboarding flow to replace the administrator password, and existing sessions were not invalidated after the change.
Recommendation
Upgrade to Nexus Repository 3 CE/Pro version 3.95.0 or later. Downloads are available at https://help.sonatype.com/en/download.html
Credit
This issue was discovered and reported responsibly by kjcao via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An account holding the nexus:* permission could reset the administrator password outside the onboarding flow without invalidating existing sessions, potentially enabling unauthorized retention of administrative access.
Q: What preconditions must be met in order to be vulnerable?
A: The attacker must hold an account with the nexus:* permission and have network access to the instance.
Q: Are there implications associated with this advisory itself?
A: As with any public vulnerability disclosure, publishing details of this issue could help a bad actor develop an exploit against unpatched systems. We encourage all users to assess their exposure and upgrade promptly.
Q: Why is Sonatype making this information available?
A: Sonatype follows a responsible disclosure process and proactively notifies users of security issues so they can take appropriate action to protect their systems.