EUVD-2026-38219
GHSA-r2g5-993q-664g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Clear
Network-reachable REST API with authenticated low-privileged write user (PR:L); AC:H because the target must have Restricted-component authorization configured; full impact via arbitrary Restricted-processor execution.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
5Blast Radius
ecosystem impact- 5 maven packages depend on org.apache.nifi:nifi-web-api (2 direct, 3 indirect)
Ecosystem-wide dependent count for version 1.12.0.
Description PRE-NVD
AnalysisAI
Authorization bypass in Apache NiFi 1.12.0 through 2.9.0 allows authenticated users with general write access to add Restricted-annotated extension components when replacing Process Groups, despite lacking the explicit Restricted-component privilege. The flaw stems from the framework failing to enforce Restricted-annotation checks during Process Group replacement, effectively letting privileged-component installation bypass its intended authorization boundary. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Technical ContextAI
Apache NiFi is a JVM-based dataflow automation platform that supports pluggable processors and controller services via extension components. The framework uses an @Restricted annotation to mark components that require additional privileges (for example, components that execute scripts or access the host file system), and operators can configure granular policies that restrict who may instantiate them. CWE-862 (Missing Authorization) applies because the Process Group replacement code path checks general write permissions on the target group but omits the Restricted-status check, so the security control is simply not invoked on that endpoint. CPE coverage is limited to cpe:/a:apache:nifi versions 1.12.0 up to (but not including) 2.9.0 across the affected branch.
RemediationAI
Vendor-released patch: upgrade to Apache NiFi 2.9.0, which removes the framework's Restricted-status authorization model and shifts the boundary to standard write permissions (see https://nifi.apache.org/ and the NIFI-15845 issue at https://issues.apache.org/jira/browse/NIFI-15845). Because the fix removes Restricted-component authorization entirely rather than adding the missing check, operators who previously relied on Restricted policies to separate trusted from semi-trusted users must redesign access control before or during the upgrade - typically by tightening component-level write policies, segmenting users into separate Process Groups with distinct write permissions, or moving sensitive extension components onto dedicated NiFi clusters. As a pre-upgrade compensating control, audit and revoke 'modify the component' or Process Group write permissions for any user who should not be able to instantiate Restricted components, and monitor flow-change provenance events for unexpected ExecuteScript, ExecuteProcess, or similar Restricted processors being added via Process Group replace operations; the trade-off is reduced self-service for legitimate dataflow authors.
The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authe
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for a
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization
Apache NiFi External XML Entity issue in SplitXML processor. Rated critical severity (CVSS 9.8), this vulnerability is r
A flaw was found in jackson-databind before 2.9.10.7. Rated high severity (CVSS 8.1), this vulnerability is remotely exp
Uncontrolled decompression in Apache NiFi 1.5.0 through 2.10.0 exposes the REST API to unauthenticated denial-of-service
Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retriev
The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not ne
When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiF
Authorization bypass in Apache NiFi 1.10.0 through 2.10.0 allows read-only authenticated users to submit Parameter Conte
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to
Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow frami
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today