CVE-2026-17599 Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint

Medium 6.9 Published 7 Aug 2026 Updated 7 Aug 2026

An attacker with nexus:* permission can change the administrator password outside onboarding, leading to privilege escalation and account takeover.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-17599?

CVE-2026-17599 is a medium-severity missing authorization vulnerability in Sonatype Nexus Repository Manager, published on 7 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Nexus Repository 3 contained an endpoint used to change the administrator account password during initial onboarding. This endpoint did not verify that onboarding was still in progress before allowing the password change, relying instead on the presence of a local onboarding artifact. As a result, an account holding the nexus:* permission could invoke the endpoint outside the intended onboarding flow to replace the administrator password, and existing sessions were not invalidated after the change.

Weakness: CWE-620

Which versions are affected by CVE-2026-17599?

It affects 1 product.

Products include Sonatype Nexus Repository Manager.

How do I fix CVE-2026-17599?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-17599 being exploited?

There is no known exploitation of CVE-2026-17599 in the wild and no public exploit code.

All Sonatype Nexus Repository Manager vulnerabilities

Sources

Also known as GHSA-jffj-qrgg-8qm5, MINI-3phq-fmv3-r8gj, MINI-x44g-6w5c-chvp.