CVE-2026-41870: Apache Nutch Server RCE Vulnerability

CVE-2026-41870 Overview

CVE-2026-41870 is a code injection and unsafe reflection vulnerability in the Apache Nutch Server REST API. The flaw combines missing authorization, improper control of dynamically-managed code resources, and use of externally-controlled input to select classes or code. It affects Apache Nutch versions 1.11 through 1.22. The Apache Nutch project has removed the Nutch Server entirely in the 1.23 release rather than patch the exposed service. Operators still running the affected REST API expose the underlying host to attacker-controlled class loading and code execution.

Critical Impact

Unauthenticated attackers with network access to the Nutch REST API can influence class selection and code generation, leading to arbitrary code execution on the crawler host.

Affected Products

• Apache Nutch 1.11 through 1.22 (Nutch Server / Nutch REST API)
• Deployments exposing the Nutch Service to untrusted networks
• Downstream crawling pipelines that embed the Nutch REST API

Discovery Timeline

• 2026-09-09 - CVE-2026-41870 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-41870

Vulnerability Analysis

The Nutch REST API exposes administrative endpoints without authorization checks. Requests can specify class names and configuration values that the server resolves at runtime through reflection. Because externally-controlled input drives class selection and dynamic resource loading, an attacker can direct the server to instantiate arbitrary classes available on the classpath. This chains directly into code injection [CWE-94], allowing execution of attacker-defined logic in the Nutch process context.

The Apache Nutch project judged the exposure severe enough that version 1.23 removes the Nutch Server component rather than harden it. Any deployment still running the REST API remains permanently exposed unless network access is restricted.

Root Cause

The root cause is the combination of missing authorization on REST endpoints and unsafe reflection over request parameters. The server accepts identifiers that control which classes are loaded and how code resources are generated. There is no allowlist restricting these identifiers to safe, expected values.

Attack Vector

An attacker sends crafted HTTP requests to a reachable Nutch REST API endpoint. The request supplies class or plugin identifiers that the server passes to reflective loading routines. The server instantiates the attacker-selected class and executes its logic under the privileges of the Nutch process. No authentication is required. Refer to the Apache Security Mailing List Thread and the OpenWall OSS-Security Update for coordination details.

Detection Methods for CVE-2026-41870

Indicators of Compromise

• Unexpected HTTP requests to Nutch REST API endpoints from untrusted source addresses
• Nutch process spawning child processes such as shells, curl, wget, or scripting interpreters
• New or modified plugin JAR files in the Nutch plugins/ directory
• Outbound network connections initiated by the Nutch JVM to unfamiliar hosts

Detection Strategies

• Inspect web and reverse proxy logs for requests to Nutch admin, job, and config endpoints from outside expected operator ranges
• Alert on Java process trees where the Nutch JVM launches native OS commands
• Monitor changes to Nutch configuration files, class paths, and plugin directories using file integrity monitoring

Monitoring Recommendations

• Forward Nutch server access logs and JVM audit output to a central logging platform for correlation
• Baseline normal Nutch outbound traffic and alert on deviations, particularly to non-crawl destinations
• Track process lineage and command-line arguments for the Nutch service to identify reflection-driven execution

How to Mitigate CVE-2026-41870

Immediate Actions Required

• Upgrade to Apache Nutch 1.23, which removes the Nutch Server component
• If upgrade is not immediately feasible, block all network access to the Nutch REST API except from trusted operator hosts
• Audit existing Nutch hosts for signs of prior exploitation, focusing on unexpected plugins and child processes
• Review the Apache Nutch security advisories for current guidance

Patch Information

Apache Nutch 1.23 resolves CVE-2026-41870 by removing the Nutch Server entirely. There is no in-place patch for versions 1.11 through 1.22; operators must upgrade or isolate the service.

Workarounds

• Restrict access to the Nutch Service to trusted users and management networks only using firewall rules or host-based ACLs
• Bind the Nutch REST listener to localhost or a management interface rather than a public address
• Place the Nutch API behind an authenticating reverse proxy that enforces client certificate or SSO controls
• Run the Nutch process under a low-privilege account with restricted filesystem and network capabilities

# Configuration example: restrict Nutch REST API access with iptables
iptables -A INPUT -p tcp --dport 8081 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8081 -j DROP