Apache Nutch 1.23 fixes three unauthenticated Nutch Server (REST API) vulnerabilities: critical JEXL-injection RCE (CVE-2026-41870), important unsafe-reflection job execution…

On 2026-09-08 the Apache Nutch project disclosed three unauthenticated vulnerabilities in the Nutch Server (Nutch REST API) component: CVE-2026-41870 (critical, remote code execution via JEXL injection, affects 1.11-1.22), CVE-2026-41871 (important,…

On 2026-09-08, three vulnerabilities in the Nutch Server (Nutch REST API) component of Apache Nutch were disclosed via oss-security. All involve missing authorization and all are fixed in Apache Nutch 1.23, which removes the Nutch Server component entirely. - CVE-2026-41870 (rated critical by the Apache Nutch project): Missing Authorization and Code Injection allow unauthenticated remote code execution via JEXL injection. Affects Apache Nutch 1.11 through 1.22. - CVE-2026-41871 (rated important): Missing Authorization and Unsafe Reflection allow unauthenticated reflection-based job execution via externally controlled class selection. Affects Apache Nutch 1.10 through 1.22. - CVE-2026-41869 (rated moderate): Missing Authorization and improper resource shutdown allow unauthenticated users to force a shutdown or interrupt running jobs. Affects Apache Nutch 1.10 through 1.22. Remediation: upgrade to Apache Nutch 1.23, which removes the Nutch Server component. Users who cannot upgrade must apply mitigations. The only specifically stated workaround (for CVE-2026-41869) is to restrict network access to instances running Nutch Server; the reports for CVE-2026-41870 and CVE-2026-41871 state that mitigations must be applied but do not specify which. Note the affected ranges differ: CVE-2026-41870 begins at version 1.11, while CVE-2026-41869 and CVE-2026-41871 begin at 1.10.