Vulnerability Details CVE-2026-17598
Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 33.4%
CVSS Severity
CVSS v3 Score 4.9
References
Products affected by CVE-2026-17598
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.91.0
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.91.1
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.92.1
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.92.2
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.92.3
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.0
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.1
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.93.2
-
cpe:2.3:a:sonatype:nexus_repository_manager:3.94.0