Executive brief
Apache Nutch Server (REST API) contains a critical flaw that allows attackers to execute arbitrary code on the server without authentication. An attacker can manipulate API requests to instantiate and execute malicious Java classes, giving them complete control over the application and any data it processes. This vulnerability affects a widely-used web crawler component and puts organizations using Nutch at severe risk of data theft, service disruption, and further network compromise.
Technical details
The vulnerability is a missing authorization and unsafe reflection flaw in the Nutch REST API (Nutch Server). An attacker can supply externally-controlled input to select and instantiate arbitrary Java classes through the API, bypassing authentication mechanisms. No user interaction or authentication is required; the attacker can trigger code execution directly by sending crafted HTTP requests to the REST endpoint. The vulnerability allows remote code execution (RCE), enabling full system compromise. Version 1.23 removes the Nutch Server entirely; for earlier versions, access restriction to trusted networks is required as a temporary mitigation.
Affected products
- Apache Nutch 1.10 through 1.22
Timeline
- 2026-09-09: disclosed
- 2026-09-08: advisory: Apache Nutch security advisory published