🔐 CVE Alert

CVE-2026-41870

HIGH 8.8

Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)

CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th

Missing Authorization, Improper Control of Generation of Code ('Code Injection'), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.11 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

CWE CWE-862 CWE-94 CWE-913 CWE-470
Vendor apache software foundation
Product apache nutch
Published Sep 9, 2026
Last Updated Sep 10, 2026
Stay Ahead of the Next One

Get instant alerts for apache software foundation apache nutch

Be the first to know when new high vulnerabilities affecting apache software foundation apache nutch are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Nutch
1.11 ≤ 1.22

References

NVD ↗ CVE.org ↗ EPSS Data ↗
lists.apache.org: https://lists.apache.org/thread/3pl59g0jzqx1bdh5w92qoftzn7c3x8j2 openwall.com: http://www.openwall.com/lists/oss-security/2026/09/08/4

Credits

🔍 The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue.