CVE-2026-17594 Nexus Repository 3 - Authorization Bypass in Repository Creation

High 8.2 Published 7 Aug 2026 Updated 7 Aug 2026

Users with delegated repository-admin privileges can bypass authorization checks to create repositories of unauthorized formats, leading to privilege escalation.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-17594?

CVE-2026-17594 is a high-severity missing authorization vulnerability in Sonatype Nexus Repository Manager, published on 7 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.

Weakness: CWE-863

Which versions are affected by CVE-2026-17594?

It affects 1 product.

Products include Sonatype Nexus Repository Manager.

How do I fix CVE-2026-17594?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-17594 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-17594 exists.

Public exploit code: 1 Nuclei template.

All Sonatype Nexus Repository Manager vulnerabilities

Sources

Also known as GHSA-9x3v-rxwx-3gx2, MINI-pvjw-772r-qfmf, MINI-vhpx-hfhx-49xp.