CVE-2026-44914
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Apache NiFi versions 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include components marked as Restricted. This lack of authorization allows users with general write access to add components with restricted access.
Risk Assessment
Organizations may be exposed to unauthorized addition of restricted access components, potentially leading to data and system security breaches.
Recommendation
It is recommended to upgrade to Apache NiFi version 2.9.0, which removes the issue with authorization for Restricted components.
Other vulnerabilities in Apache NiFi
See all- CVE-2017-5635High
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the 'anonymous' user.
- CVE-2017-7667High
Apache NiFi versions before 0.7.4 and 1.x before 1.3.0 do not set the response header that tells browsers to only allow framing with the same origin.
- CVE-2026-68980Critical
Apache NiFi 2.0.0 through 2.10.0 allows creating, reading, and deleting Assets via REST API. The framework authorizes deletion based on the Parameter Context ID without verifying Asset ownership. Installations without different authorization levels across contexts are not affected. Upgrade to 2.11.0 fixes the issue.
- CVE-2026-68979Critical
Apache NiFi versions 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. An authenticated user authorized to modify a Parameter Context but not authorized on referencing components can alter Parameter values affecting those components. If a Parameter value contains executable scripting content, updating a Parameter can result in code execution during automatic component validation. The issue applies only to deployments using component-level authorization policies. Upgrade to Apache NiFi 2.11.0 is recommended.
- CVE-2017-5636Critical
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user.
- CVE-2026-68981High
Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory.
- CVE-2026-62354Medium
Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying Parameter Context configuration are not subject to this vulnerability.
- CVE-2026-54665Medium
Apache NiFi versions 0.0.1 through 2.9.0 do not validate the values of Proxy and Forwarded headers, allowing for the construction of invalid URLs. Version 1.6.0 introduced a property to restrict Host header values, but this was not applied to alternative headers.
- CVE-2026-44911Medium
In Apache NiFi versions 1.15.0 through 2.9.0, authorization handling for component configuration verification requests allows clients with read access to submit proposed configuration properties. These properties can override the current configuration, enabling users with read access to invoke predefined verification methods with alternative settings.
- CVE-2023-40037Medium
Apache NiFi versions 1.21.0 through 1.23.0 have a vulnerability in the validation of JDBC and JNDI JMS connection URLs, allowing authenticated users to bypass this validation using custom input formatting.
Original NVD description (English source)
Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required, but framework authorization did not check restricted status when handling requests to replace Process Groups. The missing authorization permits a user with general write access to add components with Restricted status. Apache NiFi installations that do not implement specific authorization for Restricted components are not subject to this vulnerability because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation, which removes the implementation of Restricted status authorization from the framework.