CVE-2026-17598

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-17598
Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one.

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html Release Notes
https://support.sonatype.com/hc/en-us/articles/53880086360211/ Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:sonatype:nexus_repository_manager:*:*:*:*:*:*:*:*
History

23 Oct 2026, 20:10

Type Values Removed Values Added
Summary
  • (es) Sonatype Nexus Repository 3 no filtraba correctamente las claves de configuración internas de las propiedades de tarea proporcionadas por el usuario al crear o actualizar una tarea programada a través de la interfaz de usuario administrativa. Una cuenta con permiso para crear al menos un tipo de tarea programada podría proporcionar un valor de propiedad manipulado que causó que el sistema sobrescribiera la configuración de una tarea existente no relacionada en lugar de crear una nueva.

22 Sep 2026, 16:53

Type Values Removed Values Added
CPE cpe:2.3:a:sonatype:nexus_repository_manager:*:*:*:*:*:*:*:*
References () https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html - () https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html - Release Notes
References () https://support.sonatype.com/hc/en-us/articles/53880086360211/ - () https://support.sonatype.com/hc/en-us/articles/53880086360211/ - Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.9
First Time Sonatype
Sonatype nexus Repository Manager
Information

Published : 2026-08-07 17:17

Updated : 2026-10-23 20:10

NVD link : CVE-2026-17598

Mitre link : CVE-2026-17598

CVE.ORG link : CVE-2026-17598

JSON object : View

Products Affected

sonatype

  • nexus_repository_manager
CWE
CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes