CVE-2026-17598 Sonatype CVE debrief

Who should care

Administrators and users of Sonatype Nexus Repository 3, especially those with permission to create or modify scheduled tasks, should be aware of this vulnerability and take necessary precautions to prevent exploitation. This includes reviewing and restricting access to task creation and modification, as well as monitoring for suspicious activity that could indicate exploitation attempts.

Technical summary

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one. This issue highlights the importance of proper input validation and access control in task management features.

Defensive priority

Administrators should prioritize patching Sonatype Nexus Repository 3 instances to prevent potential configuration overwrite.

Recommended defensive actions

• Patch Sonatype Nexus Repository 3 instances to the latest version
• Restrict access to scheduled task creation and modification
• Monitor for suspicious task configuration changes
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record indicates that Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties. An account with permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.