CVE-2026-41870

Missing Authorization, Improper Control of Generation of Code ('Code Injection'), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.11 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/3pl59g0jzqx1bdh5w92qoftzn7c3x8j2	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/09/08/4	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:nutch:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-09-09 11:17

Updated : 2026-09-11 13:06

NVD link : CVE-2026-41870

Mitre link : CVE-2026-41870

CVE.ORG link : CVE-2026-41870

JSON object : View

Products Affected

apache

nutch

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-470

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

CWE-862

Missing Authorization

CWE-913

Improper Control of Dynamically-Managed Code Resources

{"id": "CVE-2026-41870", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41870", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-10T18:02:40.346908Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Nutch", "versions": [{"status": "affected", "version": "1.11", "versionType": "custom", "lessThanOrEqual": "1.22"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-09T11:17:14.433", "references": [{"url": "https://lists.apache.org/thread/3pl59g0jzqx1bdh5w92qoftzn7c3x8j2", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/09/08/4", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-470"}, {"lang": "en", "value": "CWE-862"}, {"lang": "en", "value": "CWE-913"}]}], "descriptions": [{"lang": "en", "value": "Missing Authorization, Improper Control of Generation of Code ('Code Injection'), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability\u00a0in Apache Nutch Server (Nutch REST API).\n\n\n\nThis issue affects Apache Nutch: from 1.11 through 1.22.\n\n\n\nUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\nIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\nPlease, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ ."}], "lastModified": "2026-09-11T13:06:07.280", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:nutch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3783F15E-7BC5-4242-87A7-FA03C40C1303", "versionEndExcluding": "1.23", "versionStartIncluding": "1.11"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}