EUVD-2026-74802
GHSA-3fr3-2597-3735
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed Nutch REST API
-
DeliverySend unauthenticated management request
-
ExploitRead crawl job/config data
-
ExecutionInvoke job stop/resource shutdown
-
ImpactDisrupt crawl pipeline and leak data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Requires a running Apache Nutch Server / Nutch REST API instance (started explicitly via bin/nutch startserver - not launched in a default Nutch install) that is network-reachable by the attacker. Given the missing-authorization flaw, no credentials, tokens, or user interaction are needed once the endpoint is reachable (PR:N/UI:N/AC:L). The primary limiting factor is exposure: the REST server is off by default and is intended to sit on trusted networks, so risk is confined to deployments that both enable it and expose it beyond trusted hosts. |
| Impact | Signals conflict on how urgent this is. CVSS is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) - network-reachable, no privileges, no user interaction, high confidentiality and availability impact - which reads as critical. Against that, EPSS is only 0.20% (10th percentile), there is no CISA KEV listing, and no public exploit was identified, indicating little evidence of opportunistic mass exploitation. The reconciling factor is deployment reality: the Nutch Server REST API is not enabled by default and is generally run inside trusted back-office/data-engineering networks, so the internet-exposed, default-config population is small even though any exposed instance is trivially abusable. Net: high impact per-instance, but real-world priority is bounded by how rarely the REST server is publicly reachable - a targeted rather than widespread risk. |
| Exploit ScenarioDerived | An attacker who discovers a network-reachable Nutch Server REST endpoint (no credentials required) enumerates active crawl jobs and reads their configuration/state, then issues stop/shutdown calls to abort in-progress crawls and release server resources, disrupting the indexing pipeline. No public exploit code is known, but the operations are simple unauthenticated HTTP calls (AC:L), so scripting them is trivial once an instance is exposed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 10, 2026
Missing authorization in the Apache Nutch Server (Nutch REST API) lets remote unauthenticated attackers read crawl data and interrupt or shut down running crawl jobs and their backing resources across Nutch 1.10 through 1.22. Because the REST API ships without access control, anyone able to reach the service can invoke management operations. No public exploit identified at time of analysis and EPSS is low (0.20%), but the fix is drastic: version 1.23 removes the Nutch Server component entirely.
Earlier versions of this analysis (1)
Unauthenticated forced shutdown and crawl-job interruption in Apache Nutch 1.10-1.22 allows any network attacker to halt the Nutch Server process or abort in-flight crawl jobs via the Nutch REST API without supplying any credentials. The root cause is missing authorization on administrative REST endpoints, a flaw tracked as NUTCH-3165 and classified under CWE-862 (Missing Authorization) plus Improper Resource Shutdown. No public exploit code or CISA KEV listing has been identified; Apache Nutch 1.23 resolves the issue by removing the REST API component entirely.
RemediationAI
Vendor-released patch: upgrade to Apache Nutch 1.23, which resolves the issue by removing the Nutch Server component altogether - plan for the loss of REST-based job orchestration and migrate any automation that depended on it to the CLI/crawl scripts. If an immediate upgrade is not possible, restrict network access to any running Nutch Server so that only trusted users/hosts can reach it: bind the REST listener to localhost or a management interface, place it behind a firewall/reverse proxy with authentication, and avoid starting the server (bin/nutch startserver) unless actively needed; the trade-off is loss of remote/programmatic crawl management. See the ASF advisories at https://nutch.apache.org/documentation/security/ and the announcement thread https://lists.apache.org/thread/ps4yhlvo6kdgmksdgb9lv1h4p0oy5fdj.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Nutch is an open-source, Java-based web crawler built on Hadoop, typically fronting search-index pipelines. The affected component is the Nutch Server, a REST API (started via bin/nutch startserver) that exposes crawl-job orchestration - creating, monitoring, stopping, and inspecting crawl jobs and their state. The root cause is classed as CWE-404 (Improper Resource Shutdown or Release), compounded by a missing-authorization design flaw: the REST endpoints perform no authentication or authorization, so any caller can query job/configuration data (confidentiality) and terminate jobs or release/shut down server resources (availability). The CPE/version data indicates the defect spans the entire 1.x REST-server lifecycle from its introduction (1.10) through 1.22.
Know when Nutch gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
REST API has no authorization so a remote attacker reaches it unauthenticated (PR:N/AC:L); it can read job data (C:H) and shut down jobs/resources (A:H), with no direct data-tampering primitive (I:N).
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
Articles & Coverage 2
Executive ViewAI
Apache Nutch Server versions 1.10-1.22 contain a critical authorization flaw that exposes the REST API to unauthenticated remote access, allowing attackers to read crawl data and terminate running jobs. Organizations using these versions face immediate risk of data breach and operational disruption; remediation requires urgent upgrade to version 1.23, which removes the vulnerable component.
Vendor-released patch: Apache Nutch 1.23 removes the vulnerable Nutch Server component. Until patching is complete, restrict network-level access to REST API endpoints; use command-line crawl interface as alternative to REST API if operationally feasible; enable API access logging to detect unauthorized requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. Rated critical sever
Unauthenticated remote code execution in the Apache Nutch Server (Nutch REST API) affects versions 1.10 through 1.22, co
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch
Code injection via the Apache Nutch Server REST API allows low-privileged remote attackers to execute arbitrary code on
Exploit-DB