Which versions of Apache NiFi are affected by CVE-2026-39816?

Apache NiFi TinkerpopClientService contains a privilege escalation vulnerability (CVE-2026-39816) that allows authenticated administrators to execute arbitrary code by bypassing permission controls.. A patch is available.

How to fix or mitigate CVE-2026-39816?

Within 24 hours: Identify all Apache NiFi instances running TinkerpopClientService and inventory administrative user accounts with code execution privileges. Within 7 days: Implement network segmentation isolating NiFi systems from critical downstream data consumers; enforce multi-factor authentication on all NiFi admin accounts; audit recent administrative activities for suspicious Execute Code operations. Within 30 days: Monitor vendor advisories for patch availability; consider disabling or restricting TinkerpopClientService if business-critical; evaluate alternative data processing services without this component.

Apache NiFi CVE-2026-39816

Q: What is the CVSS score of CVE-2026-39816?

CVE-2026-39816 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:I/V:C/RE:L/U:Green. EPSS exploitation probability: 0.0%.

EUVD-2026-28593 HIGH

Missing Authorization (CWE-862)

2026-04-24

GHSA-2j9m-25xv-mp6r

Authentication Bypass Apache Deserialization

7.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:I/V:C/RE:L/U:Green

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:I/V:C/RE:L/U:Green

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 14:23 vuln.today

CVSS changed

May 08, 2026 - 14:22 NVD

7.5 (HIGH)

CVE Published

Apr 24, 2026 - 12:21 nvd

N/A

CVE Published

Apr 24, 2026 - 12:21 nvd

HIGH 7.5

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Apache NiFi TinkerpopClientService allows authenticated high-privilege users to execute arbitrary code without proper permission validation. The service fails to enforce required Execute Code permissions, enabling privilege escalation within the NiFi environment. While CVSS scores this at 7.5 (High), real-world risk requires authenticated high-privilege access (PR:H), significantly limiting the attack surface to compromised admin accounts or malicious insiders. No public exploit code has been identified, and CISA KEV does not list this vulnerability, suggesting no confirmed active exploitation at time of disclosure.

Technical ContextAI

Apache NiFi is a dataflow automation platform that supports graph database integration via TinkerpopClientService, which enables connectivity to Apache TinkerPop-compliant graph databases like JanusGraph and Neo4j. The vulnerability stems from CWE-862 (Missing Authorization), where the service fails to validate Execute Code permissions before allowing code execution operations. The CVSS 4.0 vector indicates network-accessible (AV:N) exploitation with low complexity (AC:L) but requires high privileges (PR:H) and presents attack complexity conditions (AT:P). The 'deserialization' tag suggests the TinkerpopClientService may accept serialized graph traversal queries (Gremlin scripts) that can contain arbitrary code, executing without proper authorization checks against NiFi's permission model.

RemediationAI

Monitor the official Apache NiFi security mailing list thread at https://lists.apache.org/thread/gh9g7xwvv4l20gzff6q3367snf35ctcb for vendor-released patch version information, which has not been disclosed in the initial April 13, 2026 oss-security announcement. Until a patch is available, implement compensating controls: disable TinkerpopClientService if graph database integration is not operationally required (eliminates attack surface but removes functionality), restrict NiFi administrative role assignments to only essential personnel with verified trust levels (reduces insider threat vector but may impact operational flexibility), implement enhanced monitoring and alerting for TinkerpopClientService invocations including logging all Gremlin query submissions with user attribution (detection-focused, does not prevent exploitation), and isolate NiFi instances with TinkerpopClientService to network segments with strict egress filtering to limit post-exploitation impact (contains but does not prevent). Review and audit all high-privilege NiFi accounts for least-privilege compliance.