HIGH

CVE-2026-17603

2026-08-07 CVSS v4.0

CVSS

8.7

Description

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user.

Weakness (CWE)

CWE-94 Code Injection

EPSS Score

0.39%

Probability of exploitation in next 30 days

32.7th percentile

References

https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html https://support.sonatype.com/hc/en-us/articles/53890127489427/

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE