CVE-2026-17603: Nexus Repository 3 - HikariCP connectionInitSql Injection RCE via DataStore Configuration API
Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17603?
CVE-2026-17603 has a risk rating of 66, indicating a significant security concern.
What type of vulnerability is CVE-2026-17603?
CVE-2026-17603 is a Code Injection vulnerability due to improper restrictions on HikariCP connection properties.
How do I fix CVE-2026-17603?
To fix CVE-2026-17603, ensure that only authorized users are granted the nx-datastores-update permission and apply the latest patches from Sonatype.
What software is affected by CVE-2026-17603?
CVE-2026-17603 affects Sonatype Nexus Repository 3 and any configurations using the HikariCP connection pool.
What can attackers do with CVE-2026-17603?
Attackers with the nx-datastores-update permission can exploit CVE-2026-17603 to execute arbitrary SQL commands on the configured database.