CVE-2026-17600
Received Received - Intake

Session Persistence in Sonatype Nexus Repository 3

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: Sonatype

Description
Sonatype Nexus Repository 3 did not immediately terminate a user's active login session or revoke their cached permissions when that user's account was deleted, deactivated, or had its password changed. A user whose account was already logged in at the time of one of these actions could continue using their existing session to interact with the repository as though the account were still active, until that session independently expired. Depending on the permissions previously held, this could allow continued unauthorized access to read, modify, or delete repository content after access was intended to be revoked.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-17600
EUVD
EUVD-2026-54515

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
sonatype nexus_repository 3.95.0
sonatype nexus_repository to 3.95.0 (exc)
sonatype nexus_repository 3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Sonatype Nexus Repository 3 versions before 3.95.0. When a user's account is deleted, deactivated, or their password is changed, their active login session and cached permissions are not immediately terminated. This allows the user to continue accessing repository content using their existing session until it expires independently.

Detection Guidance

To detect this vulnerability, check for active sessions of users whose accounts were deleted, deactivated, or had passwords changed. Review Nexus Repository logs for suspicious activity from these accounts. Use commands like 'nexus status' to verify version and 'curl -u admin:password http://localhost:8081/service/rest/v1/security/users' to list users and their session status.

Impact Analysis

If an attacker has an active session when a user's account is modified, they could continue accessing repository content even after access was intended to be revoked. This could lead to unauthorized reading, modifying, or deleting of repository data depending on the user's previous permissions.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by allowing unauthorized continued access to sensitive data after user accounts are deactivated or passwords are changed. It violates principles requiring timely revocation of access to protected information.

Mitigation Strategies

Immediately upgrade to Nexus Repository 3 CE/Pro version 3.95.0 or later. After upgrading, verify that sessions for affected users are terminated by checking active sessions and reviewing logs for unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17600. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart