Quick answers
- Is CVE-2026-41870 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-41870 being exploited in the wild.
- How severe is CVE-2026-41870?
- High severity, with a CVSS score of 8.8, published 9 September 2026.
- Which products and versions are affected?
- Apache Nutch 1.11 through 1.22.
- Is there a fix for CVE-2026-41870?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-41870 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-41870?
- Check whether you run Apache Nutch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a combination of missing authorization checks and unsafe JEXL (Java Expression Language) expression evaluation in the Nutch REST API. Attackers can send maliciously crafted requests to the API endpoints that include JEXL expressions, which are then dynamically evaluated by the server without proper input validation or sandboxing. The root cause involves improper control of dynamically-managed code resources and unsafe reflection allowing arbitrary class instantiation. No authentication is required to exploit this vulnerability—the API is accessible over the network. A successful exploit results in arbitrary code execution with the privileges of the Nutch server process. Apache has patched this in version 1.23 by removing the Nutch Server entirely; for earlier versions, access must be restricted to trusted networks only.
Affected products
- Apache Nutch 1.11 through 1.22
Timeline
- 2026-09-08: disclosed
- 2026-09-09: advisory