CVE-2026-41869

Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/ps4yhlvo6kdgmksdgb9lv1h4p0oy5fdj	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/08/3	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:nutch:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-09-09 11:17

Updated : 2026-09-10 20:39

NVD link : CVE-2026-41869

Mitre link : CVE-2026-41869

CVE.ORG link : CVE-2026-41869

JSON object : View

Products Affected

apache

nutch

CWE

CWE-404

Improper Resource Shutdown or Release

CWE-862

Missing Authorization

{"id": "CVE-2026-41869", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41869", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-10T18:44:43.929784Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Nutch", "versions": [{"status": "affected", "version": "1.10", "versionType": "custom", "lessThanOrEqual": "1.22"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-09T11:17:14.290", "references": [{"url": "https://lists.apache.org/thread/ps4yhlvo6kdgmksdgb9lv1h4p0oy5fdj", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/09/08/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-404"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API).\n\n\n\nThis issue affects Apache Nutch: from 1.10 through 1.22.\n\n\n\nUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\nIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\nPlease, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ ."}], "lastModified": "2026-09-10T20:39:59.543", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:nutch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E31CA398-66FB-483F-8D18-AA45CD291668", "versionEndExcluding": "1.23", "versionStartIncluding": "1.10"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}