Vulnerability-Lookup

CVE-2026-41871 (GCVE-0-2026-41871)

Vulnerability from cvelistv5 – Published: 2026-09-09 10:45 – Updated: 2026-09-10 17:56

Title

Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)

Summary

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nutch: from 1.10 through 1.22. Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 17:56 UTC

CWE

CWE-862 - Missing Authorization
CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Assigner

apache mitre root

References

2 references

URL	Tags
https://lists.apache.org/thread/rbr63fx8vlrhzrfkn…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/09/08/5

Impacted products

1 product

Vendor	Product	Version	CPE status
Apache Software Foundation	Apache Nutch	Affected: 1.10 , ≤ 1.22 (custom)	guessed

Credits

The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-09-09T11:10:19.289Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/09/08/5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-41871",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T17:56:31.666015Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T17:56:50.962Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Nutch",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.22",
              "status": "affected",
              "version": "1.10",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMissing Authorization, Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability\u0026nbsp;in Apache Nutch Server  (Nutch REST API).\u003c/p\u003e\u003cp\u003eThis issue affects Apache Nutch: from 1.10 through 1.22.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\u003cbr\u003eIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\u003cbr\u003ePlease, also visit the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://nutch.apache.org/documentation/security/\"\u003eApache Nutch security advisories\u003c/a\u003e.\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability\u00a0in Apache Nutch Server  (Nutch REST API).\n\n\n\nThis issue affects Apache Nutch: from 1.10 through 1.22.\n\n\n\nUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\nIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\nPlease, also visit the  Apache Nutch security advisories https://nutch.apache.org/documentation/security/ ."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-470",
              "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:45:47.005Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/rbr63fx8vlrhzrfknq2l0mg0d0blsl54"
        }
      ],
      "source": {
        "defect": [
          "NUTCH-3165"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-41871",
    "datePublished": "2026-09-09T10:45:47.005Z",
    "dateReserved": "2026-04-22T06:35:10.384Z",
    "dateUpdated": "2026-09-10T17:56:50.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-41871",
      "date": "2026-09-10",
      "epss": "0.00364",
      "percentile": "0.29689"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-41871\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2026-09-09T11:17:14.570\",\"lastModified\":\"2026-09-10T20:38:51.250\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability\u00a0in Apache Nutch Server  (Nutch REST API).\\n\\n\\n\\nThis issue affects Apache Nutch: from 1.10 through 1.22.\\n\\n\\n\\nUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\\nIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\\nPlease, also visit the  Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .\"}],\"affected\":[{\"source\":\"security@apache.org\",\"affectedData\":[{\"vendor\":\"Apache Software Foundation\",\"product\":\"Apache Nutch\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"1.10\",\"lessThanOrEqual\":\"1.22\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-10T17:56:31.666015Z\",\"id\":\"CVE-2026-41871\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-470\"},{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:nutch:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.10\",\"versionEndExcluding\":\"1.23\",\"matchCriteriaId\":\"E31CA398-66FB-483F-8D18-AA45CD291668\"}]}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/rbr63fx8vlrhzrfknq2l0mg0d0blsl54\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/09/08/5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-09-09T10:45:47.005Z\"}, \"title\": \"Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)\", \"problemTypes\": [{\"descriptions\": [{\"description\": \"CWE-862 Missing Authorization\", \"lang\": \"en\", \"cweId\": \"CWE-862\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"description\": \"CWE-470 Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)\", \"lang\": \"en\", \"cweId\": \"CWE-470\", \"type\": \"CWE\"}]}], \"source\": {\"defect\": [\"NUTCH-3165\"], \"discovery\": \"EXTERNAL\"}, \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Nutch\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.10\", \"lessThanOrEqual\": \"1.22\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"descriptions\": [{\"value\": \"Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability\\u00a0in Apache Nutch Server  (Nutch REST API).\\n\\n\\n\\nThis issue affects Apache Nutch: from 1.10 through 1.22.\\n\\n\\n\\nUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\\nIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\\nPlease, also visit the  Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .\", \"lang\": \"en\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eMissing Authorization, Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability\u0026nbsp;in Apache Nutch Server  (Nutch REST API).\u003c/p\u003e\u003cp\u003eThis issue affects Apache Nutch: from 1.10 through 1.22.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\u003cbr\u003eIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\u003cbr\u003ePlease, also visit the \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://nutch.apache.org/documentation/security/\\\"\u003eApache Nutch security advisories\u003c/a\u003e.\u003cbr\u003e\u003c/p\u003e\"}]}], \"references\": [{\"url\": \"https://lists.apache.org/thread/rbr63fx8vlrhzrfknq2l0mg0d0blsl54\", \"tags\": [\"vendor-advisory\"]}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"important\"}}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"The Apache Nutch Project Management Committee would like to thank Th1nk for reporting this issue.\", \"type\": \"finder\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}}, \"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/09/08/5\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-09-09T11:10:19.289Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-41871\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-10T17:56:31.666015Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-10T17:56:43.563Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-41871\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"apache\", \"dateReserved\": \"2026-04-22T06:35:10.384Z\", \"datePublished\": \"2026-09-09T10:45:47.005Z\", \"dateUpdated\": \"2026-09-10T17:56:50.962Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-41871

Vulnerability from fkie_nvd - Published: 2026-09-09 11:17 - Updated: 2026-09-10 18:18

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security@apache.org	https://lists.apache.org/thread/rbr63fx8vlrhzrfknq2l0mg0d0blsl54
	af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2026/09/08/5

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Nutch",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.22",
              "status": "affected",
              "version": "1.10",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability\u00a0in Apache Nutch Server  (Nutch REST API).\n\n\n\nThis issue affects Apache Nutch: from 1.10 through 1.22.\n\n\n\nUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\nIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\nPlease, also visit the  Apache Nutch security advisories https://nutch.apache.org/documentation/security/ ."
    }
  ],
  "id": "CVE-2026-41871",
  "lastModified": "2026-09-10T18:18:01.053",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-41871",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-10T17:56:31.666015Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-09T11:17:14.570",
  "references": [
    {
      "source": "security@apache.org",
      "url": "https://lists.apache.org/thread/rbr63fx8vlrhzrfknq2l0mg0d0blsl54"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2026/09/08/5"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-470"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}

GHSA-5W4F-VWV7-MJ4C

Vulnerability from github – Published: 2026-09-09 12:32 – Updated: 2026-09-10 18:31

Details

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API).

This issue affects Apache Nutch: from 1.10 through 1.22.

Users are recommended to upgrade to version 1.23, which removes the Nutch Server. If an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only. Please, also visit the Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-41871"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-470"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-09T11:17:14Z",
    "severity": "CRITICAL"
  },
  "details": "Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027) vulnerability\u00a0in Apache Nutch Server  (Nutch REST API).\n\n\n\nThis issue affects Apache Nutch: from 1.10 through 1.22.\n\n\n\nUsers are recommended to upgrade to version 1.23, which removes the Nutch Server.\nIf an upgrade is not possible, user must restrict access to instances running the Nutch Service to trusted users only.\nPlease, also visit the  Apache Nutch security advisories https://nutch.apache.org/documentation/security/ .",
  "id": "GHSA-5w4f-vwv7-mj4c",
  "modified": "2026-09-10T18:31:39Z",
  "published": "2026-09-09T12:32:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41871"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/rbr63fx8vlrhzrfknq2l0mg0d0blsl54"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/09/08/5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-41871 (GCVE-0-2026-41871)

FKIE_CVE-2026-41871

GHSA-5W4F-VWV7-MJ4C

Tags

Sightings

Nomenclature