EUVD-2026-74803
GHSA-5w4f-vwv7-mj4c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable REST API with no authorization and no auth/UI (AV:N/AC:L/PR:N/UI:N); unsafe reflection yields full code execution, so C:H/I:H/A:H.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
6Description PRE-NVD
Articles & Coverage 2
AnalysisAI
Unauthenticated remote code execution in the Apache Nutch Server (Nutch REST API) affects versions 1.10 through 1.22, combining a missing authorization check with unsafe reflection that lets externally-controlled input select and instantiate arbitrary classes. Any attacker able to reach an exposed Nutch Server endpoint can invoke functionality and drive class loading without credentials, yielding full compromise of the host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the optional Apache Nutch Server (Nutch REST API) is running and network-reachable by the attacker on an affected version (1.10-1.22); this component is not part of a minimal crawl-only deployment, so environments that never start the Nutch Server are not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) describes a network-reachable, low-complexity, unauthenticated attack with full CIA impact, which is internally consistent with the described missing-authorization + unsafe-reflection RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: version 1.23, which resolves the issue by removing the Nutch Server component altogether - upgrade to 1.23 and migrate any crawl-control workflows off the REST API. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Apache Nutch Server instances running versions 1.10 through 1.22 and immediately restrict network access to Nutch REST API endpoints using firewall rules, or disable the REST API entirely if not operationally critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. Rated critical sever
Missing authorization in the Apache Nutch Server (Nutch REST API) lets remote unauthenticated attackers read crawl data
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch
Code injection via the Apache Nutch Server REST API allows low-privileged remote attackers to execute arbitrary code on
Share
External POC / Exploit Code
Leaving vuln.today