Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Apache Software Foundation/Apache Nutch (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Apache Software Foundation/Apache Nutch.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Sep 9, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 9, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 9, 2026

Sources and claim methodology

• Source referencelists.apache.org
• Source referenceopenwall.com

Related CVEs

• Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)Same apache software foundation/apache nutch package
• Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)Same apache software foundation/apache nutch package
• Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket RedemptionAlso CWE-862
• Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' ParameterAlso CWE-862
• Apache Impala: RCE via External Data Source Class LoadingAlso CWE-913
• Unauthenticated Remote Code Execution in Akana API PlatformAlso CWE-94