Apache Nutch Has an Unauthenticated RCE. The REST API Is the Door
- The Mess: Apache Nutch has a critical unauthenticated RCE in its Nutch Server REST API. The problem is JEXL injection that lets remote attackers push code into the server.
- The Damage: An exposed Nutch Server can become a remote code-execution target without credentials.
- The Fix: Upgrade to Nutch 1.23, which removes Nutch Server, or immediately restrict access to trusted users.
Apache Nutch just lost one of its nastiest attack surfaces.
CVE-2026-41870 is a critical remote code-execution vulnerability in Nutch Server, the REST API component used to control Nutch instances. Apache classifies the issue as involving missing authorization, code injection, unsafe reflection and dynamically managed code resources.
The dangerous part is simple:
No authentication is required.
An attacker who can reach the Nutch Server API can send malicious input that reaches the server’s JEXL processing path.
That turns an API request into a potential code-execution primitive.
JEXL Becomes the Execution Path
The vulnerability is tracked internally as NUTCH-3165 and NUTCH-3168.
The affected range is Apache Nutch 1.11 through 1.22 when Nutch Server is present. Apache published the vulnerability as critical and credited researcher Th1nk for reporting it.
The problem is not simply that an endpoint accepts unexpected input.
The REST API exposes functionality that eventually allows attacker-controlled data to influence code execution through JEXL.
Once the attacker controls the expression being evaluated, the security boundary around the API effectively collapses.
This is why an Internet-facing Nutch Server is a bad idea.
Apache Did Something Unusual
The fix is not another small patch to the vulnerable REST endpoint.
Apache Nutch 1.23 removes Nutch Server entirely.
That is the recommended upgrade path from the project itself.
This is an important detail.
Administrators upgrading to 1.23 are not simply receiving a patched version of the vulnerable server. The component responsible for this attack surface is gone.
If upgrading is not immediately possible, Apache recommends restricting access to Nutch Service instances to trusted users only.
There Are Two More Nutch Server Bugs
CVE-2026-41870 did not arrive alone.
Apache also disclosed CVE-2026-41869, which allows unauthenticated forced shutdown and job interruption, and CVE-2026-41871, which allows unauthenticated reflection-based job execution through the Nutch Server REST API.
That makes the situation considerably more interesting than a single isolated RCE.
Three vulnerabilities hit the same server component.
And Apache’s answer is to remove that component in version 1.23.
Is There a Public Exploit?
There is currently no confirmed public proof of concept and no CISA KEV listing for CVE-2026-41870.
That does not make an exposed Nutch Server safe.
The vulnerability is unauthenticated and network reachable. Security researchers already have the advisory, the affected versions and the general exploitation mechanism.
The window between disclosure and exploitation can be much shorter than the window between disclosure and an organization’s next maintenance cycle.
Check Your Nutch Deployment
The first question is not whether Nutch is installed.
It is whether Nutch Server is running and reachable.
A forgotten crawler host with a REST API exposed to an internal network can still be useful to an attacker who has already compromised another system.
An Internet-facing instance is a much bigger problem.
If Nutch 1.11–1.22 is running with Nutch Server, move to 1.23.
If that cannot happen immediately, restrict access to trusted systems and networks.
Do not expose the REST API directly to the Internet.
Bugstoday Opinion
This is exactly the kind of vulnerability that gets ignored because the product sounds obscure.
Apache Nutch is not a flashy enterprise platform.
It is an open-source web crawler.
That does not matter once an unauthenticated REST endpoint can become an RCE primitive.
The most interesting part is actually Apache’s fix.
They did not try to bolt another authorization check onto the same architecture.
They removed Nutch Server.
Sometimes the best security patch is deleting the attack surface.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- Apache Nutch Security Advisory
- Apache Security Mailing List
- CVE Program — CVE-2026-41870
- Apache Nutch Jira — NUTCH-3165
- Apache Nutch Jira — NUTCH-3168
- Openwall OSS-Security
