EUVD-2026-74803
GHSA-5w4f-vwv7-mj4c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate exposed Nutch REST API
-
DeliverySend crafted API request (no auth)
-
ExploitExternally-controlled class selection via unsafe reflection
-
ExecutionLoad/execute attacker-chosen code
-
ImpactCode execution on Nutch host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V15 - Secure Coding and Architecture Reflection safety, class allowlisting
|
| Exploitation Conditions | Exploitation requires that the optional Apache Nutch Server (Nutch REST API) is running and network-reachable by the attacker on an affected version (1.10-1.22); this component is not part of a minimal crawl-only deployment, so environments that never start the Nutch Server are not exposed. Given CVSS PR:N/UI:N, no authentication or user interaction is needed once the REST API is reachable. The principal limiting factor is network exposure: the API ships without authorization, so real-world risk hinges on whether the Nutch Service is exposed beyond a trusted network segment. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) describes a network-reachable, low-complexity, unauthenticated attack with full CIA impact, which is internally consistent with the described missing-authorization + unsafe-reflection RCE. Countervailing signals: EPSS is only 0.36% (30th percentile), there is no CISA KEV listing, and no public POC is referenced, so there is no evidence of active or widespread exploitation yet. The realistic risk is heavily gated by exposure - the Nutch Server is an optional, non-default component that is often run on internal/trusted networks, so the population of internet-facing instances is likely small even though each exposed instance is fully compromisable. Note the input Tags label this 'Information Disclosure,' which understates the impact: unsafe reflection here yields code execution (C:H/I:H/A:H), not merely disclosure. |
| Exploit ScenarioDerived | An attacker discovers an internet- or intranet-exposed Nutch Server REST endpoint and, without authenticating, sends a crafted API request whose parameters name an attacker-chosen class/code path. The unsafe reflection resolves and executes that code in the Nutch process context, giving the attacker code execution on the crawler host. No public exploit is currently identified, but the low complexity and lack of authentication make weaponization straightforward once the endpoint is located. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 10, 2026
Unauthenticated remote code execution in the Apache Nutch Server (Nutch REST API) affects versions 1.10 through 1.22, combining a missing authorization check with unsafe reflection that lets externally-controlled input select and instantiate arbitrary classes. Any attacker able to reach an exposed Nutch Server endpoint can invoke functionality and drive class loading without credentials, yielding full compromise of the host. No public exploit identified at time of analysis and EPSS is low (0.36%), but the CVSS 9.8 rating and trivial network vector make exposed instances high priority.
Earlier versions of this analysis (1)
Unauthenticated remote job execution is possible in Apache Nutch 1.10-1.22 via the Nutch Server REST API, which combines missing authorization controls (CWE-862) with externally-controlled class selection through Java reflection (CWE-470). Any network-reachable actor can craft HTTP requests to the REST API that trigger server-side class instantiation or job execution without supplying any credentials. The Apache PMC response - complete removal of the Nutch Server in 1.23 rather than a targeted patch - indicates the component lacked a sufficient security foundation to be safely retained; no public exploit or KEV listing has been identified at time of analysis.
RemediationAI
Vendor-released patch: version 1.23, which resolves the issue by removing the Nutch Server component altogether - upgrade to 1.23 and migrate any crawl-control workflows off the REST API. If upgrading is not immediately possible, the vendor's prescribed workaround is to restrict network access to any host running the Nutch Service so only trusted users can reach it (for example via firewall rules, binding to loopback, or placing it behind an authenticated reverse proxy); the trade-off is that any automation or remote clients depending on the open REST API will need corresponding access grants and will otherwise break. Review the Apache Nutch security advisories at https://nutch.apache.org/documentation/security/ and the fix details in https://issues.apache.org/jira/browse/NUTCH-3165 before rolling out.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Nutch is an open-source, extensible web crawler built on the Hadoop/Lucene ecosystem, typically deployed for large-scale content harvesting. The vulnerable component is the optional Nutch Server, which exposes a REST API to control crawl jobs. The root cause is CWE-470 (Use of Externally-Controlled Input to Select Classes or Code, 'Unsafe Reflection'): the API accepts attacker-supplied identifiers that are used to resolve and load Java classes/code at runtime, so an attacker can steer execution to arbitrary or attacker-influenced code paths. This is compounded by a missing authorization layer on the REST API, meaning the dangerous reflection path is reachable by any caller. The fix is drastic - version 1.23 removes the Nutch Server entirely rather than hardening it, indicating the maintainers judged the REST server component unsafe to retain.
Know when Nutch gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable REST API with no authorization and no auth/UI (AV:N/AC:L/PR:N/UI:N); unsafe reflection yields full code execution, so C:H/I:H/A:H.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
Articles & Coverage 2
Executive ViewAI
Organizations running Apache Nutch Server versions 1.10 through 1.22 face immediate risk of complete system compromise from external attackers requiring no credentials. No vendor patch is available, creating urgent operational and security exposure for any exposed instances. Leadership should prioritize immediate containment and network isolation to prevent data breach and operational disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network isolation-restrict REST API access to authorized internal IP ranges only via firewall; (2) Disable REST API if not operationally required; (3) Deploy Web Application Firewall rules to detect and block suspicious requests; (4) Implement network segmentation to contain lateral movement in event of compromise; (5) Enable comprehensive logging and alerting on Nutch service activity; (6) Prepare upgrade plan for immediate deployment upon vendor patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. Rated critical sever
Missing authorization in the Apache Nutch Server (Nutch REST API) lets remote unauthenticated attackers read crawl data
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch
Code injection via the Apache Nutch Server REST API allows low-privileged remote attackers to execute arbitrary code on
Exploit-DB