EUVD-2026-74802
GHSA-3fr3-2597-3735
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
REST API has no authorization so a remote attacker reaches it unauthenticated (PR:N/AC:L); it can read job data (C:H) and shut down jobs/resources (A:H), with no direct data-tampering primitive (I:N).
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
5Description PRE-NVD
Articles & Coverage 2
AnalysisAI
Missing authorization in the Apache Nutch Server (Nutch REST API) lets remote unauthenticated attackers read crawl data and interrupt or shut down running crawl jobs and their backing resources across Nutch 1.10 through 1.22. Because the REST API ships without access control, anyone able to reach the service can invoke management operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a running Apache Nutch Server / Nutch REST API instance (started explicitly via bin/nutch startserver - not launched in a default Nutch install) that is network-reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals conflict on how urgent this is. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Apache Nutch 1.23, which resolves the issue by removing the Nutch Server component altogether - plan for the loss of REST-based job orchestration and migrate any automation that depended on it to the CLI/crawl scripts. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Nutch instances running versions 1.10-1.22 and implement network access controls (firewall, VPN, or private subnet isolation) to block external REST API access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. Rated critical sever
Unauthenticated remote code execution in the Apache Nutch Server (Nutch REST API) affects versions 1.10 through 1.22, co
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch
Code injection via the Apache Nutch Server REST API allows low-privileged remote attackers to execute arbitrary code on
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today