https://seclists.org/oss-sec/2026/q3/669: CVE-2026-41871: Apache Nutch: Unauthenticated flection-based job execution in Nutch Server (Nutch ST API)

Q: Which deployments are exposed?

Apache Nutch versions 1.10 through 1.22 are affected when running the Nutch Server/Nutch REST API. The advisory specifically advises restricting access to instances running the Nutch Service.

Q: What access does an attacker need?

The issue is described as unauthenticated job execution through unsafe reflection in the Nutch REST API. An attacker would need access to the exposed Nutch Service API; the advisory does not state that any prior authentication is required.

Q: What should be done if an upgrade cannot be performed immediately?

Restrict access to instances running the Nutch Service to trusted users only. This is the mitigation explicitly recommended by the advisory.

Q: What version resolves the issue?

Upgrade to Apache Nutch 1.23. According to the advisory, this version removes the Nutch Server.

Published Sep 8, 2026

Updated

Affected Software

1 affected component

Apache Nutch>=1.10<=1.22

Frequently Asked Questions

Which deployments are exposed?

Apache Nutch versions 1.10 through 1.22 are affected when running the Nutch Server/Nutch REST API. The advisory specifically advises restricting access to instances running the Nutch Service.

What access does an attacker need?

The issue is described as unauthenticated job execution through unsafe reflection in the Nutch REST API. An attacker would need access to the exposed Nutch Service API; the advisory does not state that any prior authentication is required.

What should be done if an upgrade cannot be performed immediately?

Restrict access to instances running the Nutch Service to trusted users only. This is the mitigation explicitly recommended by the advisory.

What version resolves the issue?

Upgrade to Apache Nutch 1.23. According to the advisory, this version removes the Nutch Server.