Sonatype Nexus Security Advisory
Date: August 7, 2026
Affected Versions: All Nexus Repository 3 CE/Pro versions from 3.20.0 up to and including 3.94.x
Fixed in Version: Nexus Repository 3 CE/Pro version 3.95.0
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N = 8.7 (High)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Sonatype Guide: https://guide.sonatype.com/vulnerability/CVE-2026-17603
Summary
Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user.
Recommendation
Upgrade to Nexus Repository 3 CE/Pro version 3.95.0 or later. Downloads are available at https://help.sonatype.com/en/download.html
Immediate Mitigation Options
If upgrading immediately is not possible, restrict the nx-datastores-update permission to only fully trusted administrators, and audit any existing DataStore configurations for unexpected advanced connection-pool properties (particularly connectionInitSql).
Credit
This issue was discovered and reported responsibly by Shreyas Chavhan (HackerOne: https://hackerone.com/shreyaschavhan, Github: https://github.com/shreyaschavhan, LinkedIn: https://www.linkedin.com/in/shreyaschavhan) via Sonatype’s Bug Bounty Program.
Frequently Asked Questions
Q: What is the risk associated with this vulnerability?
A: An attacker with the nx-datastores-update permission can execute arbitrary SQL against the underlying database, and on H2-backed deployments (the default), escalate this to remote code execution as the Nexus process user.
Q: What preconditions must be met in order to be vulnerable?
A: The attacker must hold the nx-datastores-update permission. This is a named permission, not a default capability of every logged-in account; it must be explicitly granted via a role.
Q: Are there implications associated with this advisory itself?
A: Disclosing this vulnerability could allow bad actors to develop exploits targeting unpatched systems. We strongly encourage all users to assess their exposure and upgrade promptly upon reading this advisory.
Q: Why is Sonatype making this information available?
A: Sonatype follows a responsible disclosure process and proactively notifies users of security issues so they can take appropriate action to protect their systems.