What’s Vulnerable › Vulnerabilities

CVE-2026-41871: Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-09 · updated 2026-09-10
• Weakness: CWE-470

Description

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

Affected products

• Apache Software Foundation Apache Nutch: from 1.10 before 1.23 — fixed in 1.23

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Nutch 1.23. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/rbr63fx8vlrhzrfknq2l0mg0d0blsl54
• http://www.openwall.com/lists/oss-security/2026/09/08/5

Get alerted when CVE-2026-41871 or the next vulnerability affects your stack