CVE-2026-17598Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration

Description

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html patchRelease Notes
• https://support.sonatype.com/hc/en-us/articles/53880086360211/ vendor-advisoryVendor Advisory