CVE-2026-62354

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the 'anonymous' user.

Apache NiFi versions before 0.7.4 and 1.x before 1.3.0 do not set the response header that tells browsers to only allow framing with the same origin.

Apache NiFi 2.0.0 through 2.10.0 allows creating, reading, and deleting Assets via REST API. The framework authorizes deletion based on the Parameter Context ID without verifying Asset ownership. Installations without different authorization levels across contexts are not affected. Upgrade to 2.11.0 fixes the issue.

Apache NiFi versions 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. An authenticated user authorized to modify a Parameter Context but not authorized on referencing components can alter Parameter values affecting those components. If a Parameter value contains executable scripting content, updating a Parameter can result in code execution during automatic component validation. The issue applies only to deployments using component-level authorization policies. Upgrade to Apache NiFi 2.11.0 is recommended.

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user.

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory.

Apache NiFi versions 0.0.1 through 2.9.0 do not validate the values of Proxy and Forwarded headers, allowing for the construction of invalid URLs. Version 1.6.0 introduced a property to restrict Host header values, but this was not applied to alternative headers.

Apache NiFi versions 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include components marked as Restricted. This lack of authorization allows users with general write access to add components with restricted access.

In Apache NiFi versions 1.15.0 through 2.9.0, authorization handling for component configuration verification requests allows clients with read access to submit proposed configuration properties. These properties can override the current configuration, enabling users with read access to invoke predefined verification methods with alternative settings.

Apache NiFi versions 1.21.0 through 1.23.0 have a vulnerability in the validation of JDBC and JNDI JMS connection URLs, allowing authenticated users to bypass this validation using custom input formatting.