---
id: CVE-2026-17603
title: >-
  Nexus Repository 3 did not sufficiently restrict which HikariCP
  connection-pool properties could be set through the DataStore configuration
  API
summary: >-
  Nexus Repository 3 did not sufficiently restrict which HikariCP
  connection-pool properties could be set through the DataStore configuration
  API. A user holding the nx-datastores-update permission could set the
  connectionInitSql property …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
vendor: sonatype
product: nexus_repository_manager
affected:
  - 'nexus_repository_manager >= 3.20.0, < 3.95.0'
patched:
  - nexus_repository_manager 3.95.0
published: '2026-08-07'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T16:43:51.417'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-17603'
references:
  - url: >-
      https://help.sonatype.com/en/sonatype-nexus-repository-3-95-0-release-notes.html
    label: 103e4ec9-0a87-450b-af77-479448ddef11
  - url: 'https://support.sonatype.com/hc/en-us/articles/53890127489427/'
    label: 103e4ec9-0a87-450b-af77-479448ddef11
tags:
  - nvd
epss: 0.00483
epssPercentile: 0.39069
ingestedAt: '2026-09-22T17:07:07.351Z'
---

## Overview

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user.

## Affected

- `nexus_repository_manager >= 3.20.0, < 3.95.0`

## Remediation

Upgrade past the affected range:

- `nexus_repository_manager 3.95.0`