CVE-2026-41871

CRITICAL 9.8

Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

CWE	CWE-862 CWE-470
Vendor	apache software foundation
Product	apache nutch
Published	Sep 9, 2026
Last Updated	Sep 10, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache nutch

Be the first to know when new critical vulnerabilities affecting apache software foundation apache nutch are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Nutch

1.10 ≤ 1.22

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/rbr63fx8vlrhzrfknq2l0mg0d0blsl54 openwall.com: http://www.openwall.com/lists/oss-security/2026/09/08/5

Credits

The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue.