CVE-2026-41871
Apache Nutch’s REST API has a critical flaw that lets anyone send requests that can cause the server to run arbitrary code. The vulnerability is due to missing authorization checks and unsafe use of external input for class selection. It can be fixed by upgrading to version 1.23, which removes the vulnerable server component.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Apache Nutch versions 1.10 through 1.22 are affected. Users running the Nutch Server REST API should upgrade or restrict access.
Real-world impact
An attacker who can reach the Nutch REST API could run arbitrary code on the server, effectively taking full control of the machine.
Why this severity
The CVSS score of 9.8 reflects that the flaw is exploitable over the network with no authentication, and it can lead to complete compromise of confidentiality, integrity, and availability.
What to do about it
- 01Upgrade Apache Nutch to version 1.23 or later, which removes the Nutch Server.
- ›Restrict access to the Nutch Service to trusted users only.
NVD-referenced vendor advisory
Timeline
- Sep 9, 2026 · 5d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 10, 2026 · 3d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- lists.apache.org/thread/rbr63fx8vlrhzrfknq2l…mailing listvendor advisory
- openwall.com/lists/oss-security/2026/09/…mailing listthird party advisory