EUVD-2026-54517
GHSA-m4g7-vv6g-5mpc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L for required task-creation permission; AV:N for web UI delivery; S:U as impact stays within the application; no confidentiality breach described.
Primary rating from Vendor (Sonatype).
CVSS VectorVendor: Sonatype
Lifecycle Timeline
2DescriptionCVE.org
Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one.
AnalysisAI
Scheduled task configuration overwrite in Sonatype Nexus Repository 3 enables a low-privileged authenticated user - holding permission to create at least one scheduled task type - to corrupt the configuration of an unrelated existing task via mass assignment against the administrative UI. By injecting internal configuration keys into user-supplied task property values, the attacker causes the system to redirect its write operation onto a pre-existing task rather than creating a new one, disrupting or manipulating that task's behavior. No public exploit or active exploitation has been identified; vendor-released patch 3.95.0 resolves the issue.
Technical ContextAI
Sonatype Nexus Repository 3 (CPE: cpe:2.3:a:sonatype:nexus_repository_3:*:*:*:*:*:*:*:*) is an enterprise artifact repository manager ubiquitous in DevOps and CI/CD pipelines for managing Maven, npm, Docker, and other artifacts. The vulnerability is classified as CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), commonly known as mass assignment or parameter pollution. The root cause is the absence of a server-side blocklist or allowlist filtering internal configuration namespace keys from task property inputs submitted through the administrative UI. When a scheduled task is created or updated, the backend dynamically maps submitted property keys to configuration attributes without sanitizing reserved internal keys, allowing an attacker-controlled key to resolve to the identity or configuration space of an existing, unrelated task.
RemediationAI
Upgrade Sonatype Nexus Repository 3 to version 3.95.0 or later, which contains the vendor-released fix as documented in the release notes at https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html. If an immediate upgrade is operationally infeasible, restrict task-creation permissions to the minimum necessary set of fully trusted administrative accounts using Nexus RBAC roles; this reduces the attack surface since exploitation requires the ability to create at least one scheduled task type, but it does not eliminate the underlying vulnerability in the task scheduling code itself. Additionally, audit existing scheduled task configurations for unauthorized modifications as a post-incident hygiene step. Refer to the Sonatype advisory at https://support.sonatype.com/hc/en-us/articles/53880086360211/ for any additional vendor guidance.
More in Nexus Repository 3
View allIncorrect authorization in the Nexus Repository 3 CE/Pro repository-creation UI allows an authenticated user with a form
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated low-privileged user - who holds the 'update
Remote code execution in Sonatype Nexus Repository 3 is achievable by any user holding the nx-datastores-update permissi
Insufficient session expiration in Sonatype Nexus Repository 3 allows a previously-authenticated user to retain full rep
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to
Authorization bypass in Sonatype Nexus Repository 3's component upload API lets an account holding only read/browse priv
Script execution enforcement failure in Sonatype Nexus Repository 3 allows privileged authenticated users to invoke pre-
Incorrect authorization in Sonatype Nexus Repository 3 allows a low-privileged user holding the `nexus:blobstores:create
Unverified password change in Sonatype Nexus Repository 3 allows any account holding the nexus:* permission to overwrite
Stored XSS in Sonatype Nexus Repository 3 enables an authenticated user holding blob store management permissions to inj
The webhook shared secret stored in Nexus Repository 3's capability configuration is returned unmasked via the capabilit
JEXL expression sandbox bypass in Sonatype Nexus Repository 3's Content Selector feature allows authenticated users hold
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today