CVE-2026-41870: Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)
Apache fixed CVE-2026-41870, a critical unauthenticated RCE via JEXL injection in Nutch Server's REST API affecting versions 1.11-1.22.
CVE-2026-41870 describes a critical Missing Authorization and Code Injection vulnerability in Apache Nutch Server (the Nutch REST API), enabling unauthenticated remote code execution via JEXL injection. Affected versions are Apache Nutch 1.11 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server; users who cannot upgrade must apply mitigations.
- Unauthenticated JEXL injection leads to remote code execution
- Affects Apache Nutch 1.11 through 1.22
- Rated critical by the Apache Nutch project
- Fixed in Apache Nutch 1.23, which removes the Nutch Server component
- CVEs
- CVE-2026-41870
- Vendors
- Apache Software Foundation
- Products
- Apache Nutch
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41870 | Unauthenticated RCE via JEXL injection in Apache Nutch REST API | 8.8 | <1% |
From the original article
Posted by Sebastian Nagel on Sep 08 Severity: critical Affected versions: - Apache Nutch 1. 11 through 1. 22 Description: Missing Authorization, Improper Control of Generation of Code ('Code Injection'), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API).
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.