Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Apache Nutch allows anyone to run commands via REST API

CVE-2026-41871 · published 1 month ago
Summary

The Nutch web service lets anyone send specially crafted requests that cause the server to run internal jobs without checking who is making the request. This could let an attacker trigger actions that affect your crawling and indexing processes. Update to Nutch 1.23 or later, or limit access to the Nutch service to trusted users only.

What to do
  • Update apache nutch to version 1.23 or later.
Affected software
VendorProductAffected versions
apache software foundation apache nutch <= 1.22
apache nutch >= 1.10, < 1.23
cpe:2.3:a:apache:nutch:*:*:*:*:*:*:*:*
Original advisory text
Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)
Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API).



This issue affects Apache Nutch: from 1.10 through 1.22.



Users are recommended to upgrade to version 1.23, which removes the Nutch Server.
If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.
Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CWE-862Missing Authorization
Timeline
Published9 Sep 2026
Updated7 Oct 2026
First seen9 Sep 2026
Sources
CVE-2026-41871 · NVD
CVE-2026-41871 · MITRE
Track software like this
Free during beta