CVE-2026-17598
Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property value that caused the system to overwrite the configuration of an unrelated, existing task instead of creating a new one.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.3
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
- EPSS probability
- 0.25%
- CWE
- CWE-915
- Published
- 2026-08-07
- Last modified
- 2026-08-07
Affected products
- Sonatype Nexus Repository 3
Weakness type
Related vulnerabilities
- CVE-2026-85408 — Eleveo Quality Management Conversation events dynamically-determined object attributes
- CVE-2026-84430 — gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes
- CVE-2026-83557 — jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
- CVE-2026-78038 — Job argument injection via :args overrides primary_key and tenant in AshOban
- CVE-2026-77144 — Broken Access Control in extension "Events 2" (events2)
- CVE-2026-71504 — Dolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset
- CVE-2026-78416 — Authenticated RCE via `condition.config` JSON cleanse bypass
- CVE-2026-62315 — Frappe: Mass assignment via set_value