Which versions of Apache NiFi are affected by CVE-2026-44911?

A critical authorization flaw in Apache NiFi versions 1.15.0-2.9.0 enables read-only users to execute privileged operations that should require write access, creating pathways for credential…. A patch is available.

How to fix or mitigate CVE-2026-44911?

Within 24 hours: Inventory all Apache NiFi deployments and identify instances running versions 1.15.0 through 2.9.0; prioritize production environments. Within 7 days: Deploy Apache NiFi 2.10.0 to all affected systems with validated rollback procedures. Within 30 days: Complete patching across all environments and confirm upgrade stability through operational validation.

Apache NiFi CVE-2026-44911

Q: What is the CVSS score of CVE-2026-44911?

CVE-2026-44911 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:L/U:Amber. EPSS exploitation probability: 0.3%.

EUVD-2026-38218 LOW

Incorrect Authorization (CWE-863)

2026-06-20

GHSA-qvj8-gwpm-4x49

Authentication Bypass Apache Nifi

2.3

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:L/U:Amber

vuln.today AI

5.4 MEDIUM

Network-accessible REST API requires read-level authentication (PR:L); no special attack complexity once access exists; no persistent configuration change, so limited and symmetric C/I impact with no availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 22, 2026 - 08:22 NVD

2.3 (LOW)

Analysis Generated

Jun 22, 2026 - 06:22 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

5 maven packages depend on org.apache.nifi:nifi-web-api (2 direct, 3 indirect)

Ecosystem-wide dependent count for version 1.15.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Incorrect authorization enforcement in Apache NiFi 1.15.0 through 2.9.0 allows read-privileged users to submit configuration verification requests containing arbitrary proposed properties, bypassing the write-access requirement. The nifi-web-api REST endpoints for component configuration verification accepted proposed configuration overrides from any authenticated user with read access, enabling those users to invoke predefined verification methods - such as testing connectivity, credentials, or remote service endpoints - with attacker-supplied settings. No public exploit has been identified at time of analysis, and the fix is confirmed available in Apache NiFi 2.10.0.

Technical ContextAI

Apache NiFi is a data flow automation platform exposing a browser-based UI and REST API (org.apache.nifi:nifi-web-api) for designing and managing data pipelines with components such as processors, controller services, and reporting tasks. Each extension component type exposes a 'verify configuration' REST endpoint that accepts proposed configuration properties and executes predefined checks - for example, testing a database connection string, verifying remote endpoint reachability, or validating credentials - returning feedback to the caller. The vulnerability arises because these verification endpoints checked for read authorization rather than write authorization before accepting proposed configuration overrides. Jira NIFI-15875 describes this as inconsistent authorization handling across multiple REST API resources in the Core Framework, where common authorization logic was absent. The root cause maps to CWE-863 (Incorrect Authorization): the system performed an access control check but used an insufficiently privileged role as the threshold. No CWE was formally assigned in the provided data.

RemediationAI

Upgrade to Apache NiFi 2.10.0, which standardizes authorization handling for all configuration verification REST API resources to require write access before accepting proposed configuration properties. The fix is confirmed resolved in Jira NIFI-15875 on 2026-05-01 and implemented via GitHub Pull Request #11179. For organizations unable to upgrade immediately, the advisory identifies a structural compensating control: removing differentiated read/write role separation so that all authenticated users possess equivalent permissions eliminates the authorization gap - however, this trade-off sacrifices the least-privilege posture that multi-tenant deployments rely on. An additional defensive layer is to restrict network access to the NiFi web API to known-trusted IP ranges or VPN endpoints, reducing the population of users who can reach the verification endpoints. See https://nifi.apache.org/ and https://issues.apache.org/jira/browse/NIFI-15875 for official guidance.