Critical severity · published Sep 9, 2026
CVE-2026-41871
Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API).
This issue affects Apache Nutch: from 1.10 through 1.22.
Users are recommended to upgrade to version 1.23, which removes the Nutch Server.
If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.
Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Apache Nutch · Apache Software Foundation
1.10 through 1.22 · source: vendor
NU
Nutch · Apache
1.10 before 1.23 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41871
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41871
Mailing List
https://lists.apache.org/thread/rbr63fx8vlrhzrfknq2l0mg0d0blsl54
Mailing List
http://www.openwall.com/lists/oss-security/2026/09/08/5
More from Apache Nutch
9.1
CVE-2026-41869
Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)
8.8
CVE-2026-41870
Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)