CVE-2026-17603CWE-94code-injection

CVE-2026-17603

High · published August 7, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00483 · 40.7th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-07T21:17Z
Affected products (1)
ProductVersionsFixed in
sonatype/nexus_repository_manager≥ 3.20.0, < 3.95.03.95.0
References (2)
https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html · 103e4ec9-0a87-450b-af77-479448ddef11https://support.sonatype.com/hc/en-us/articles/53890127489427/ · 103e4ec9-0a87-450b-af77-479448ddef11
EPSS history
Timeline
  • 07 AUG 16:07Z
    Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API
    cvelistv5