Do Son 
Apache has disclosed three Apache Nutch vulnerabilities in the Nutch Server REST API. The most serious, CVE-2026-41870, allows unauthenticated remote code execution. All three carry no authentication requirement, so exposed instances face real risk.
Why It Matters
Nutch is a widely used, production-ready web crawler. Many teams run it for large-scale data acquisition. An exposed Nutch Server therefore becomes a direct path to code execution on the host.
How the Attacks Work
The critical flaw, CVE-2026-41870, stems from JEXL injection. It combines code injection with unsafe reflection in the REST API. As a result, an attacker can run commands without logging in.
The second bug, CVE-2026-41871, abuses externally controlled input to select classes. It enables unauthenticated reflection-based job execution. The third, CVE-2026-41869, lets attackers force a shutdown and interrupt running jobs.
Affected Versions
The critical RCE affects Apache Nutch 1.11 through 1.22. The reflection and shutdown flaws affect 1.10 through 1.22. No public proof-of-concept or in-the-wild exploitation has been confirmed at this time.
Patch and Mitigation
Apache recommends upgrading to version 1.23, which removes the Nutch Server entirely. You can get it from the official Apache Nutch download page. If you cannot upgrade, restrict access to the Nutch Service to trusted users only.
For further guidance, review the Apache Nutch security documentation. Given the unauthenticated nature of these Apache Nutch vulnerabilities, prompt action is the safest course.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
