CVE-2026-41870: Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)
Apache fixed CVE-2026-41870, a critical unauthenticated RCE via JEXL injection in Nutch Server's REST API affecting versions 1.11-1.22.
CVE-2026-41870 describes a critical Missing Authorization and Code Injection vulnerability in Apache Nutch Server (the Nutch REST API), enabling unauthenticated remote code execution via JEXL injection. Affected versions are Apache Nutch 1.11 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server; users who cannot upgrade must apply mitigations.
- Unauthenticated JEXL injection leads to remote code execution
- Affects Apache Nutch 1.11 through 1.22
- Rated critical by the Apache Nutch project
- Fixed in Apache Nutch 1.23, which removes the Nutch Server component
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-41870 | Unauthenticated RCE via JEXL injection in Apache Nutch REST API The Nutch Server component of Apache Nutch (its REST API) fails to require authorization for requests (CWE-862) and allows externally controlled input to select classes and dynamically managed code resources (CWE-470, CWE-913), culminating in JEXL (Java Expression Language) injection that is evaluated server-side (CWE-94). An unauthenticated attacker who can reach the Nutch REST API can send crafted requests whose injected expressions are executed by the server, gaining remote code execution in the context of the Nutch process. All Apache Nutch releases from 1.11 through 1.22 are affected when the Nutch Server is running; version 1.23 resolves the issue by removing the Nutch Server entirely. No CVSS score has been assigned yet, the flaw is not in CISA's KEV, and no public proof-of-concept or confirmed in-the-wild exploitation is known. Do: Upgrade to Apache Nutch 1.23, which removes the Nutch Server; if an upgrade is not possible, restrict access to instances running the Nutch Service to trusted users only using authentication and network/firewall rules. Check whether your deployment runs the Nutch Server/REST API and whether it is reachable from untrusted networks, and monitor the Apache Nutch security advisories page (https://nutch.apache.org/documentation/security/) as a CVSS score and PoC may emerge. | 8.8 | <1% |
| nichelikely low thousands of deployments at most (exact installed base unknown) |
Posted by Sebastian Nagel on Sep 08 Severity: critical Affected versions: - Apache Nutch 1.11 through 1.22 Description: Missing Authorization, Improper Control of Generation of Code ('Code Injection'), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.11 through 1.22....
This source does not provide full text. Read it at seclists.org.