CVE-2026-17603
Received Received - Intake

Nexus Repository 3 HikariCP Property Injection RCE

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: Sonatype

Description
Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-17603
EUVD
EUVD-2026-54513

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sonatype nexus_repository From 3.20.0 (inc) to 3.94.x (inc)
sonatype nexus_repository From 3.95.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Sonatype Nexus Repository 3 versions 3.20.0 through 3.94.x. It allows users with the nx-datastores-update permission to set the connectionInitSql property in HikariCP connection-pool settings. This property executes arbitrary SQL on every new database connection. On default H2 database deployments, this can lead to remote code execution as the Nexus process user.

Detection Guidance

Check Nexus Repository 3 DataStore configurations for unexpected advanced HikariCP properties, particularly connectionInitSql. Review logs for suspicious SQL execution patterns or unauthorized permission usage.

Impact Analysis

An attacker with the nx-datastores-update permission could exploit this to execute arbitrary SQL commands, potentially gaining control over the Nexus Repository server. This could lead to data breaches, unauthorized access, or system compromise. The impact is higher if the default H2 database is used.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Upgrade to Nexus Repository 3 CE/Pro version 3.95.0 or later. If upgrading is not possible, restrict the nx-datastores-update permission to trusted users and audit DataStore configurations for unexpected connectionInitSql settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17603. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart