CVE-2026-17599

CVE-2026-17599 represents a compound vulnerability with two distinct but interrelated failure modes. First, the application used filesystem artifact presence as a security gate for an onboarding endpoint rather than maintaining server-controlled state — an architectural decision that makes the security boundary externally observable and reproducible. Second, password change on this administrative account failed to invalidate existing sessions, allowing an attacker who changes the admin password to retain their privileged session indefinitely while locking out the legitimate administrator. The permission model interaction is critical: `nexus:*` permission was sufficient to trigger the onboarding endpoint, but this permission tier was never designed to distinguish between legitimate administrative use and an attacker's attempt to subvert the authentication anchor itself. Holding administrative authority doesn't mean the system should trust that principal to manipulate its own authentication state machine. This is a recurring pattern in enterprise software where privilege is conflated with authorization — the permission grants capability, but the specific operation (credential rotation via onboarding flow) requires contextual authorization that was never enforced. The compounding risk extends beyond account takeover. Nexus 3 typically serves as a trusted artifact source for downstream CI/CD pipelines. An attacker who seizes the admin account and retains session access controls what artifacts are approved and propagated. This transforms a credentials vulnerability into a supply chain integrity issue — every system trusting artifacts from this Nexus instance becomes part of the casualty radius. CVSS 6.9 scores this as a single-system compromise; it does not account for the architectural position of Nexus as an integrity anchor for deployment pipelines. A further concern: in many onboarding implementations using the file-artifact pattern, the marker file is never removed after setup completes. This means the attack surface isn't limited to 'during onboarding' — it's perpetually open if the artifact was created at any point in the system's history. Check whether the marker file persists post-setup in your environment. For defenders: audit your Nexus 3 deployment for any marker files in the configuration directory that gate security-critical transitions. Verify whether `nexus:*` permission holders can access endpoints that should require additional contextual authorization. Review session management behavior during credential operations — all existing sessions should be invalidated upon administrative password change. Consider whether Nexus 3 acts as a trust anchor for downstream systems and adjust your threat model accordingly: a credentials compromise here is not just an admin lockout, it's potential artifact poisoning.

Reviewed through automated stages and approved by a human before publication.