Vulnerability Description
Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one.
Related Weaknesses (CWE)
References
- https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html
- https://support.sonatype.com/hc/en-us/articles/53880086360211/
FAQ
What is CVE-2026-17598?
CVE-2026-17598 is a documented vulnerability. Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account ...
How severe is CVE-2026-17598?
CVSS scoring is not yet available for CVE-2026-17598. Check NVD for updates.
Is there a patch for CVE-2026-17598?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.