CVE-2026-41871

Analyzed Analyzed - Analysis Complete

Missing Authorization and Unsafe Reflection in Apache Nutch

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: Apache Software Foundation

Description

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-41871

EUVD

EUVD-2026-74803

Affected Vendors & Products

Vendor	Product	Version / Range
apache	nutch	From 1.10 (inc) to 1.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-470	The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Attack-Flow Graph

Executive Summary

This is a Missing Authorization and Unsafe Reflection vulnerability in Apache Nutch Server (Nutch REST API). It affects versions 1.10 through 1.22. The flaw allows unauthenticated users to execute jobs via externally controlled input, potentially leading to arbitrary code execution.

Detection Guidance

To detect this vulnerability, check if your Apache Nutch version is between 1.10 and 1.22 by running: nutch version. If the Nutch Server (REST API) is running, verify if it is accessible from untrusted networks. Use network scanning tools like nmap to identify open ports associated with Nutch Server (default port 8081).

Check for unauthorized job submissions by reviewing Nutch Server logs for unexpected job execution requests. Ensure access controls are enforced on the REST API endpoint.

Impact Analysis

Unauthenticated attackers could exploit this to run arbitrary jobs on your system, potentially leading to unauthorized access, data breaches, or system compromise. Restricting access to trusted users is recommended if upgrading is not possible.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized access to sensitive data through the Nutch REST API. Missing authorization and unsafe reflection may lead to unauthorized code execution, exposing personal or health data without proper controls.

Mitigation Strategies

Upgrade Apache Nutch to version 1.23 or later, which removes the vulnerable Nutch Server component. If upgrading is not possible, restrict access to the Nutch Server to trusted users only by configuring firewall rules or network policies.

Disable the Nutch Server REST API if not required. Monitor for any signs of unauthorized access or job submissions in logs. Consult Apache Nutch security advisories for additional guidance.

Hi! I’m here to help you understand CVE-2026-41871. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70