Sonatype · Nexus Repository 3 · CVE-2026-17603
**Name of the Vulnerable Software and Affected Versions**
Nexus Repository 3 (affected versions not specified)
**Description**
Insufficient restrictions on HikariCP connection-pool properties within the DataStore configuration API allow a user with the `nx-datastores-update` permission to set the `connectionInitSql` property. This enables the execution of arbitrary SQL against the configured database whenever a new connection is established. When using the default H2 database backend, this flaw can be exploited to achieve remote code execution with the privileges of the Nexus process user.
**Recommendations**
At the moment, there is no information about a newer version that contains a fix for this vulnerability.