As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-41871: Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)
CVE-2026-41871 affects Apache Nutch versions 1.10 through 1.22 and involves missing authorization controls and unsafe reflection in the Nutch REST application programming interface (API). An unauthenticated attacker could exploit externally-controlled input to select and execute arbitrary classes or code through the Nutch Server. The vulnerability carries important severity, and Apache recommends upgrading to version 1.23, which removes the Nutch Server entirely.
Why it matters: Organizations running Apache Nutch 1.10 through 1.22 face unauthenticated remote code execution risk and must upgrade to 1.23 or implement access controls immediately.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-41871: Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)
Apache Nutch versions 1.10 through 1.22 contain an unauthenticated remote code execution vulnerability in the Nutch REST application programming interface (API) caused by missing authorization checks and unsafe reflection of user-supplied input. The vulnerability allows attackers to execute arbitrary jobs without authentication. Apache recommends upgrading to version 1.23, which removes the Nutch Server component entirely.
Why it matters: Organizations running Apache Nutch 1.10 through 1.22 face immediate risk of unauthorized job execution and potential remote code execution; patching to 1.23 or implementing access controls to the application programming interface (API) is required.
- Source published
- First seen by Cybersecurity Tracker