Executive brief
Apache Nutch Server is a web crawler and search engine component that provides a REST API for remote interaction. An unauthenticated attacker can inject arbitrary JEXL expressions through the API, leading to remote code execution on the server. This allows complete system compromise without requiring any valid credentials or user interaction.
Technical details
The vulnerability is a combination of missing authorization checks and unsafe JEXL (Java Expression Language) expression evaluation in the Nutch REST API. Attackers can send maliciously crafted requests to the API endpoints that include JEXL expressions, which are then dynamically evaluated by the server without proper input validation or sandboxing. The root cause involves improper control of dynamically-managed code resources and unsafe reflection allowing arbitrary class instantiation. No authentication is required to exploit this vulnerability—the API is accessible over the network. A successful exploit results in arbitrary code execution with the privileges of the Nutch server process. Apache has patched this in version 1.23 by removing the Nutch Server entirely; for earlier versions, access must be restricted to trusted networks only.
Affected products
- Apache Nutch 1.11 through 1.22
Timeline
- 2026-09-08: disclosed
- 2026-09-09: advisory