Apache Nutch 1.23 fixes three unauthenticated Nutch Server (REST API) vulnerabilities: critical JEXL-injection RCE (CVE-2026-41870), important unsafe-reflection job execution…
On 2026-09-08 the Apache Nutch project disclosed three unauthenticated vulnerabilities in the Nutch Server (Nutch REST API) component: CVE-2026-41870 (critical, remote code execution via JEXL injection, affects 1.11-1.22), CVE-2026-41871 (important,…
On 2026-09-08, three vulnerabilities in the Nutch Server (Nutch REST API) component of Apache Nutch were disclosed via oss-security. All involve missing authorization and all are fixed in Apache Nutch 1.23, which removes the Nutch Server component entirely. - CVE-2026-41870 (rated critical by the Apache Nutch project): Missing Authorization and Code Injection allow unauthenticated remote code execution via JEXL injection. Affects Apache Nutch 1.11 through 1.22. - CVE-2026-41871 (rated important): Missing Authorization and Unsafe Reflection allow unauthenticated reflection-based job execution via externally controlled class selection. Affects Apache Nutch 1.10 through 1.22. - CVE-2026-41869 (rated moderate): Missing Authorization and improper resource shutdown allow unauthenticated users to force a shutdown or interrupt running jobs. Affects Apache Nutch 1.10 through 1.22. Remediation: upgrade to Apache Nutch 1.23, which removes the Nutch Server component. Users who cannot upgrade must apply mitigations. The only specifically stated workaround (for CVE-2026-41869) is to restrict network access to instances running Nutch Server; the reports for CVE-2026-41870 and CVE-2026-41871 state that mitigations must be applied but do not specify which. Note the affected ranges differ: CVE-2026-41870 begins at version 1.11, while CVE-2026-41869 and CVE-2026-41871 begin at 1.10.
- Component affected: Nutch Server (Nutch REST API) in Apache Nutch; all three vulnerabilities involve missing authorization.
- CVE-2026-41870 - critical: unauthenticated remote code execution via JEXL injection (Missing Authorization + Code Injection); affects Apache Nutch 1.11 through 1.22.
- CVE-2026-41871 - important: unauthenticated reflection-based job execution via externally controlled class selection (Missing Authorization + Unsafe Reflection); affects Apache Nutch 1.10 through 1.22.
- CVE-2026-41869 - moderate: unauthenticated forced shutdown and job interruption (Missing Authorization + improper resource shutdown); affects Apache Nutch 1.10 through 1.22.
- Fix: Apache Nutch 1.23, which removes the Nutch Server component entirely.
- Workaround: restrict network access to instances running Nutch Server (stated for CVE-2026-41869); the reports for CVE-2026-41870 and CVE-2026-41871 say mitigations are required but do not specify them.
- Affected version ranges differ: CVE-2026-41870 starts at 1.11; CVE-2026-41869 and CVE-2026-41871 start at 1.10; all run through 1.22.
- Disclosed via oss-security on 2026-09-08; the reports do not mention any known exploitation or provide exploit code.
Coverage timelineoldest first · each row is one article
- · 8d agoCVE-2026-41869: Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)
oss-security· 22
Apache Nutch CVE-2026-41869 (moderate) lets unauthenticated users force shutdown or interrupt jobs via the Nutch Server REST API; fixed in 1.23.
- · 8d agoCVE-2026-41870: Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)
Apache fixed CVE-2026-41870, a critical unauthenticated RCE via JEXL injection in Nutch Server's REST API affecting versions 1.11-1.22.
- · 8d agoCVE-2026-41871: Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)
Apache fixed CVE-2026-41871, an unauthenticated unsafe-reflection job execution flaw in Nutch Server's REST API affecting versions 1.10-1.22.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-41871 | Unauthenticated reflection-based job execution in Apache Nutch Server REST API CVE-2026-41871 is a missing-authorization flaw (CWE-862) combined with unsafe reflection (CWE-470) in the Nutch Server component, i.e., the Nutch REST API, affecting Apache Nutch versions 1.10 through 1.22. The REST API fails to properly authorize requests, so unauthenticated or untrusted users can send API calls whose externally controlled input determines which classes or code are loaded and executed. An attacker who can reach the exposed Nutch Server can therefore trigger reflection-based job execution, potentially running arbitrary classes or jobs on the server. Only deployments running the optional Nutch Server (REST API) on Nutch 1.10 through 1.22 are affected. There is currently no public proof of concept, no known in-the-wild exploitation, and the issue is not in CISA KEV; the CVSS score has not yet been assigned. Do: Upgrade to Apache Nutch 1.23, which removes the vulnerable Nutch Server component. If upgrading is not possible, restrict access to any instance running the Nutch Service/REST API to trusted users only, e.g., via firewall rules, ACLs, or an authenticating reverse proxy. Check whether any Nutch Server instances are exposed beyond trusted networks and review the Apache Nutch security advisories page for updates. | 9.8 group max | <1% |
| nichelikely low hundreds to low thousands of deployments (optional Nutch Server component in a niche open-source crawler) |