CVE-2026-41869: Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)
Apache Nutch CVE-2026-41869 (moderate) lets unauthenticated users force shutdown or interrupt jobs via the Nutch Server REST API; fixed in 1.23.
A missing authorization and improper resource shutdown flaw in the Nutch Server REST API allows unauthenticated users to force a shutdown or interrupt running jobs. Apache Nutch versions 1.10 through 1.22 are affected. Version 1.23 fixes the issue by removing the Nutch Server; where upgrading is not possible, administrators must restrict access to instances running Nutch Server.
- Unauthenticated users can trigger forced shutdowns or job interruptions via the REST API
- Affects Nutch 1.10 through 1.22; fixed in 1.23, which removes Nutch Server
- Workaround: restrict network access to instances running Nutch Server
- CVEs
- CVE-2026-41869
- Vendors
- Apache
- Products
- Apache NutchNutch Server
- Organizations
- ASF
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41869 | Unauthenticated job interruption and shutdown in Apache Nutch Server REST API | 9.1 | <1% |
From the original article
Posted by Sebastian Nagel on Sep 08 Severity: moderate Affected versions: - Apache Nutch 1. 10 through 1. 22 Description: Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API).
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.