ZeroHour

CVE-2026-41871

niche

Unauthenticated reflection-based job execution in Apache Nutch Server REST API

CVSS 3.1
9.8 critical
EPSS
<1%p30
Published
()
Modified
AI analysis

CVE-2026-41871 is a missing-authorization flaw (CWE-862) combined with unsafe reflection (CWE-470) in the Nutch Server component, i.e., the Nutch REST API, affecting Apache Nutch versions 1.10 through 1.22. The REST API fails to properly authorize requests, so unauthenticated or untrusted users can send API calls whose externally controlled input determines which classes or code are loaded and executed. An attacker who can reach the exposed Nutch Server can therefore trigger reflection-based job execution, potentially running arbitrary classes or jobs on the server. Only deployments running the optional Nutch Server (REST API) on Nutch 1.10 through 1.22 are affected. There is currently no public proof of concept, no known in-the-wild exploitation, and the issue is not in CISA KEV; the CVSS score has not yet been assigned.

What to do: Upgrade to Apache Nutch 1.23, which removes the vulnerable Nutch Server component. If upgrading is not possible, restrict access to any instance running the Nutch Service/REST API to trusted users only, e.g., via firewall rules, ACLs, or an authenticating reverse proxy. Check whether any Nutch Server instances are exposed beyond trusted networks and review the Apache Nutch security advisories page for updates.

Affected
Apache Nutch (Nutch Server / Nutch REST API)1.10 through 1.22; fixed in 1.23, which removes the Nutch Server
Estimated exposure
nichelikely low hundreds to low thousands of deployments (optional Nutch Server component in a niche open-source crawler) — No public install or internet-exposure counts are available in the data; the estimate is based on Apache Nutch being a niche open-source web crawler whose affected Nutch Server (REST API) is an optional service typically run internally or…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

Vendors
apache
Products
nutch
Weakness
CWE-470, CWE-862
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the news

CVE-2026-41871: Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)

Apache fixed CVE-2026-41871, an unauthenticated unsafe-reflection job execution flaw in Nutch Server's REST API affecting versions 1.10-1.22.

CVE-2026-41871 describes a Missing Authorization and Unsafe Reflection vulnerability in Apache Nutch Server (the Nutch REST API), rated important by Apache. Affected versions are Apache Nutch 1.10 through 1.22, allowing unauthenticated reflection-based job execution via externally controlled class selection. Users are recommended to upgrade to version 1.23, which removes the Nutch Server; users who cannot upgrade must apply mitigations.

oss-security · 7d agoVulnerabilityCVE-2026-418711