CVE-2026-17594: Nexus Repository 3 - Authorization Bypass in Repository Creation
Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x contain an incorrect authorization vulnerability (CWE-863) in the repository-creation user interface. An individual user account holding a delegated repository-admin privilege scoped to a specific repository format could create a repository of a different, unauthorized format, because authorization was checked against one request field while a separate, attacker-controlled field determined the repository format actually created. This does not affect the anonymous user, which cannot hold this privilege by default. Fixed in version 3.95.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nexus Repository 3 CE/Proto a version that resolves this vulnerability.Fixed in 3.95.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17594?
CVE-2026-17594 has a risk rating of 43.
How do I fix CVE-2026-17594?
To fix CVE-2026-17594, upgrade Nexus Repository 3 to version 3.95.0 or later.
What systems are affected by CVE-2026-17594?
CVE-2026-17594 affects Nexus Repository 3 CE/Pro versions 3.0.0 through 3.94.x.
What type of vulnerability is CVE-2026-17594?
CVE-2026-17594 is an incorrect authorization vulnerability classified as CWE-863.
What impact does CVE-2026-17594 have?
CVE-2026-17594 allows users with delegated repository-admin privileges to create unauthorized repositories.