Login Request a demo
High severity · published Aug 7, 2026
CVE-2026-17603
Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API
8.8
CVSS
0.9%
EPSS
No
On KEV
Description
Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NR
Nexus Repository 3 · Sonatype
3.20.0 before 3.95.0 · source: vendor
NR
Nexus Repository Manager · Sonatype
3.20.0 before 3.95.0 · source: NVD
Affected product
NR
Nexus Repository 3
Sonatype
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-17603
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-17603
Release Notes
https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html
Vendor Advisory
https://support.sonatype.com/hc/en-us/articles/53890127489427/
More from Nexus Repository 3
9.8
CVE-2019-7238
Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability
9.8
CVE-2026-5189
Nexus Repository 3 - Hardcoded Credential in Internal Database Component
9.8
CVE-2019-9629
Sonatype Nexus Repository Manager before 3.17.0 establishes a default administrator user with weak defaults (fixed credentials)
9.8
CVE-2017-17717
Sonatype Nexus Repository Manager through 2.14.5 has weak password encryption with a hardcoded CMMDwoV value in the LDAP integration feature
8.8
CVE-2026-17600
Nexus Repository 3 - Session Not Invalidated on User Account Deletion or Deactivation