CVE-2026-82561
MediumCVSS 6.5Summary
Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition. Framework authorization for these methods was limited to read and write privileges on the Process Group itself, unlike the corresponding asynchronous update request methods, which also authorize the encapsulated components and referenced Controller Services, Parameter Contexts, and Parameter Providers. As a result, an authenticated user with write access could modify or remove components in descendant Process Groups protected by more restrictive access policies.
Risk Assessment
A user with write access to a Process Group can bypass component-level security policies, modifying or removing protected components and binding them to unauthorized Controller Services and Parameter Contexts. Impact is limited to stopped components and applies only to deployments using component-level authorization policies.
Recommendation
Upgrade to Apache NiFi 2.12.0, which applies consistent reference resolution and component authorization across Process Group replacement and versioned flow update methods.
Other vulnerabilities in Apache NiFi
See all- CVE-2026-86089Low
Apache NiFi 2.11.0 provides REST API methods to migrate the contents of a version-controlled Process Group into a Connector, but the framework authorizes both methods against the target Connector alone without evaluating access to the involved Process Groups. An authenticated user with read access to a Connector can enumerate identifiers, names, and flow registry details of version-controlled Process Groups outside their granted read policies, and a user with write access can migrate a Process Group without write access to it.
- CVE-2026-81866Low
Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets and Secrets referenced in the proposed configuration. An authenticated user authorized to modify a Connector but not to read a referenced Parameter Provider could apply Secret values backed by that Parameter Provider, and the methods accepted Asset identifiers without verifying ownership by the Connector being configured.
- CVE-2026-70469High
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests including the standard Content-Encoding header indicating gzip encoding. However, the framework enforcement filter did not check multiple instances of the Content-Encoding header or non-standard gzip encoding identifiers, allowing a malicious client to send crafted requests that could consume excessive amounts of memory.
- CVE-2017-5635High
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the 'anonymous' user.
- CVE-2017-7667High
Apache NiFi versions before 0.7.4 and 1.x before 1.3.0 do not set the response header that tells browsers to only allow framing with the same origin.
- CVE-2026-68980Critical
Apache NiFi 2.0.0 through 2.10.0 allows creating, reading, and deleting Assets via REST API. The framework authorizes deletion based on the Parameter Context ID without verifying Asset ownership. Installations without different authorization levels across contexts are not affected. Upgrade to 2.11.0 fixes the issue.
- CVE-2026-68979Critical
Apache NiFi versions 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. An authenticated user authorized to modify a Parameter Context but not authorized on referencing components can alter Parameter values affecting those components. If a Parameter value contains executable scripting content, updating a Parameter can result in code execution during automatic component validation. The issue applies only to deployments using component-level authorization policies. Upgrade to Apache NiFi 2.11.0 is recommended.
- CVE-2017-5636Critical
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user.
- CVE-2026-68981High
Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory.
- CVE-2026-62354Medium
Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying Parameter Context configuration are not subject to this vulnerability.
Original NVD description (English source)
Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was limited to read and write privileges on the Process Group itself, unlike the corresponding asynchronous update request methods, which also authorize the components encapsulated in the Process Group along with referenced Controller Services, Parameter Contexts, and Parameter Providers. As a result of the missing authorization, an authenticated user with write access to a Process Group could supply a flow definition that modifies or removes components in descendant Process Groups protected by more restrictive access policies, and could bind components to Controller Services and Parameter Contexts without authorization for those referenced components. Existing verification checks limited the impact to stopped components, and the issue applies only to deployments that use component-level authorization policies, because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.12.0 is the recommended mitigation, which applies consistent reference resolution and component authorization across Process Group replacement and versioned flow update methods