Apache Nutch EUVD-2026-74801

Exploitation requires the Nutch Server REST API to be actively running - this is an optional component not present in all Nutch deployments and not enabled by default in all configurations. The attacker must possess low-privilege credentials sufficient to authenticate to the REST API (confirmed by PR:L in the CVSS vector). The REST API must be reachable from the attacker's network position. Exploitation is bounded by: (1) Nutch Server must be deployed and running - organizations using only the Nutch command-line crawler without the Server component are not exposed; (2) the attacker must hold valid API credentials even at the lowest privilege level; (3) the API endpoint must not be firewalled from the attacker's origin. Organizations that have not deployed Nutch Server, or have restricted REST API access to a trusted internal network segment, face significantly reduced direct exposure.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity flaw requiring only low-level credentials, resulting in full system impact - even a mid-sized municipal IT team in leszno operating an internal Nutch crawl cluster should treat this as a priority remediation if the REST API is network-accessible. However, the EPSS score of 0.43% (36th percentile) indicates low observed exploitation activity at time of analysis, and the CVE does not appear in the CISA KEV catalog. The Nutch Server REST API is an optional, non-default component not universally deployed, which materially limits the exposed population compared to core infrastructure software. The primary real-world risk is to organizations that have deployed Nutch Server in environments where API credentials have been issued to untrusted users or where the REST API is inadvertently reachable from untrusted networks. The multi-CWE nature of the flaw suggests that individually patching endpoints would be insufficient, consistent with the vendor's decision to eliminate the component in 1.23.

An attacker holding any valid low-privilege Nutch REST API credential sends a crafted API request that supplies attacker-controlled input to an endpoint that uses unsafe reflection or dynamic code evaluation to load or invoke Java classes. Because the API's authorization checks are insufficient, the low-privilege role is enough to reach the vulnerable code path, causing the Nutch Server JVM to instantiate or execute attacker-specified code with the privileges of the Nutch process. No public exploit code has been identified at time of analysis, but the vulnerability class - code injection via unsafe reflection in a Java REST API - is well-understood and exploit development requires only standard Java tooling once an attacker has API access.