CVE-2026-17598CWE-915

CVE-2026-17598

Medium · published August 7, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
12.8
In the wild
Unconfirmed
What it is

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00228 · 12.8th percentile
Weakness
CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
Published
2026-08-07T21:17Z
Affected products (1)
ProductVersionsFixed in
sonatype/nexus_repository_manager≥ 3.91.0, < 3.95.03.95.0
References (2)
https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html · 103e4ec9-0a87-450b-af77-479448ddef11https://support.sonatype.com/hc/en-us/articles/53880086360211/ · 103e4ec9-0a87-450b-af77-479448ddef11
EPSS history
Timeline
  • 07 AUG 16:07Z
    Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration
    cvelistv5