CVE-2026-41869

Analyzed Analyzed - Analysis Complete

Missing Authorization in Apache Nutch Server

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: Apache Software Foundation

Description

Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-41869

EUVD

EUVD-2026-74802

Affected Vendors & Products

Vendor	Product	Version / Range
apache	nutch	From 1.10 (inc) to 1.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-404	The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-41869 is a vulnerability in Apache Nutch Server (Nutch REST API) versions 1.10 through 1.22. It involves missing authorization, improper resource shutdown, and job interruption risks. Attackers could exploit this to force an unauthenticated shutdown or disrupt running jobs.

Detection Guidance

To detect this vulnerability, check if your Apache Nutch version is between 1.10 and 1.22 by running: 'nutch version'. If the Nutch Server (REST API) is running, it may be vulnerable. Verify if the service is exposed to untrusted networks.

Impact Analysis

This vulnerability could allow attackers to shut down the Nutch Server without authentication or interrupt running jobs. This may lead to service disruption, data processing delays, or loss of functionality for users relying on the Nutch REST API.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access or disruption of services. Missing authorization and improper resource shutdown risks may lead to unauthorized data exposure or processing interruptions, which are critical concerns under these regulations.

Mitigation Strategies

Immediately upgrade to Apache Nutch 1.23 to remove the Nutch Server. If upgrading is not possible, restrict access to the Nutch Service to trusted users only.

Hi! I’m here to help you understand CVE-2026-41869. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70