CVE-2026-41869
CRITICAL 9.1 ALL-YEARSMissing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .
Severe if exploited (CVSS 9.1), but no confirmed exploitation. Patch on a normal cadence.
Exploitation likelihood
0.7%chance of exploitation in 30 days · 53rd percentile
Impact if exploited
9.1CVSS 3.1 · CRITICAL · ADP
- ConfidentialityHigh
- IntegrityNone
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept & exploit code
No public exploit or proof-of-concept code is catalogued for this CVE (no ExploitDB, Nuclei, or CISA-KEV entry). It may still exist — search GitHub or check the references below.
Weakness (CWE)
- CWE-862: Missing Authorization
- CWE-404: Improper Resource Shutdown or Release
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Apache | Nutch | ≥ 1.10 and < 1.23 |
All CVSS metrics
- CRITICAL 9.1 v3.1 · ADP Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - CRITICAL 9.1 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H