CVE-2026-17603 Sonatype CVE debrief

Who should care

Organizations using Nexus Repository 3, especially those with untrusted users holding the nx-datastores-update permission, should review and address this vulnerability to prevent potential SQL injection and remote code execution attacks.

Technical summary

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user.

Defensive priority

Organizations using Nexus Repository 3 should review and restrict HikariCP connection-pool properties through the DataStore configuration API to prevent potential SQL injection attacks.

Recommended defensive actions

• Review and restrict HikariCP connection-pool properties through the DataStore configuration API
• Monitor for suspicious activity related to nx-datastores-update permission usage
• Consider upgrading to a version of Nexus Repository 3 that addresses this vulnerability
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE description indicates that Nexus Repository 3 did not sufficiently restrict HikariCP connection-pool properties, allowing a user with nx-datastores-update permission to execute arbitrary SQL. On the default H2 database backend, this could lead to remote code execution as the Nexus process user. However, detailed information about affected versions, patching, or vendor statements is not provided in the source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.