CVE-2026-17598
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating scheduled tasks via the admin UI. An account with permission to create at least one task type could supply a crafted value that overwrote the configuration of an unrelated existing task instead of creating a new one.
Risk Assessment
The risk involves potential overwriting of existing task configurations by unauthorized users, leading to system disruption or unintended schedule changes. This could also enable privilege escalation.
Recommendation
It is recommended to update Nexus Repository 3 to a patched version and to restrict task creation permissions to trusted users. Also, regularly audit task configurations.
Original NVD description (English source)
Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one.