CVE-2026-41871: Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)
Apache fixed CVE-2026-41871, an unauthenticated unsafe-reflection job execution flaw in Nutch Server's REST API affecting versions 1.10-1.22.
CVE-2026-41871 describes a Missing Authorization and Unsafe Reflection vulnerability in Apache Nutch Server (the Nutch REST API), rated important by Apache. Affected versions are Apache Nutch 1.10 through 1.22, allowing unauthenticated reflection-based job execution via externally controlled class selection. Users are recommended to upgrade to version 1.23, which removes the Nutch Server; users who cannot upgrade must apply mitigations.
- Unauthenticated unsafe reflection allows arbitrary job/class execution
- Affects Apache Nutch 1.10 through 1.22
- Fixed in Apache Nutch 1.23, which removes the Nutch Server component
- Disclosed via the Apache Nutch project with severity rated important
- CVEs
- CVE-2026-41871
- Vendors
- Apache Software Foundation
- Products
- Apache Nutch
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-41871 | Unauthenticated reflection-based job execution in Apache Nutch Server REST API | 9.8 | <1% |
From the original article
Posted by Sebastian Nagel on Sep 08 Severity: important Affected versions: - Apache Nutch 1. 10 through 1. 22 Description: Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API).
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.