CVE-2026-41869: Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)
Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API).
This issue affects Apache Nutch: from 1.10 through 1.22.
Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Nutch (Nutch Server / Nutch REST API; Nutch ST API)to a version that resolves this vulnerability.Fixed in 1.23 - Compensating control
If an upgrade is not possible, restrict access to instances running the Nutch Service (Nutch Server / Nutch REST API and Nutch ST API) to trusted users only.
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Nutch versions 1.10 through 1.22 are affected when running the Nutch Server REST API. The issue concerns instances running the Nutch Service.
What access does an attacker need?
An attacker can exploit the issue without authentication if they can reach the Nutch Server REST API. The vulnerability allows forced shutdown and interruption of jobs.
What should be done if an upgrade cannot be performed immediately?
Restrict access to instances running the Nutch Service so that only trusted users can reach them. This limits exposure to the unauthenticated REST API.
What is the recommended remediation?
Upgrade to Apache Nutch 1.23. This version removes the Nutch Server.