EUVD-2026-38216
GHSA-8vm2-c32j-mvfr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:D/RE:L/U:Green
Network-reachable without authentication via crafted HTTP headers; impact limited to URL/redirect manipulation, not data exfiltration or code execution, yielding C:L/I:L/A:N.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
AnalysisAI
Host header injection in Apache NiFi 0.0.1 through 2.9.0 enables network-accessible clients to supply arbitrary values via X-ProxyHost and X-Forwarded-Host HTTP headers, causing the application to construct attacker-controlled qualified URLs used in HTTP redirects and data references. Although NiFi introduced an allowlist-based Host header control (nifi.web.proxy.host) in version 1.6.0, that validation was never extended to the alternative proxy and forwarded headers, leaving a persistent gap across roughly a decade of releases. No public exploit code has been identified at time of analysis and CVE-2026-54665 is not listed in CISA KEV; practical risk centers on open-redirect abuse, link manipulation, and potential bypass of same-origin assumptions rather than direct code execution.
Technical ContextAI
Apache NiFi's embedded Jetty web server (org.apache.nifi:nifi-jetty) processes several non-standard HTTP headers - including X-ProxyHost, X-Forwarded-Host, and related forwarded headers - that allow reverse proxies and load balancers to communicate the original host to the application. NiFi uses these values to construct fully-qualified URLs for HTTP Location redirects, UI links, and inter-node replication references. Jetty 12 tightened constraints on the standard Host header in relation to TLS SNI and DNS SANs, but those constraints do not apply to the proxy/forwarded headers. The vulnerability's root cause is classic improper input validation (analogous to CWE-20): NiFi had a partial control in place (nifi.web.proxy.host allowlist since 1.6.0) but did not apply it to the X-ProxyHost and X-Forwarded-Host headers. No CWE has been formally assigned to this CVE. The affected Maven artifact is org.apache.nifi:nifi-jetty spanning versions 0.0.1 through 2.9.0. The fix in 2.10.0 gates the new header validation on an HTTPS configuration, meaning plain-HTTP deployments do not receive the validation benefit even after upgrading.
RemediationAI
Vendor-released patch: Apache NiFi 2.10.0. Upgrading to 2.10.0 is the primary and recommended fix; it implements validation of X-ProxyHost and X-Forwarded-Host headers against the existing nifi.web.proxy.host allowlist property. Note that activating this validation requires the application to be configured with HTTPS - HTTP-only deployments will not benefit from the header validation even after upgrading, so enabling TLS is a co-requisite. Operator steps: update the nifi-jetty dependency to 2.10.0, configure HTTPS per the NiFi Administration Guide, and explicitly populate the nifi.web.proxy.host property with the allowed proxy hostnames and ports. As a compensating control for organizations that cannot immediately upgrade, configure the upstream reverse proxy (nginx, HAProxy, Traefik, AWS ALB) to strip X-ProxyHost and X-Forwarded-Host request headers from untrusted clients and replace them with allowlisted values. This eliminates the attack surface entirely, independent of the NiFi version. Trade-off: stripping these headers means NiFi will fall back to the standard Host header for URL construction, which may break legitimate reverse-proxy deployments that rely on these headers for URL rewriting. The advisory references https://nifi.apache.org/ and the Jira fix is linked to GitHub Pull Request #11268.
The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authe
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for a
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization
Apache NiFi External XML Entity issue in SplitXML processor. Rated critical severity (CVSS 9.8), this vulnerability is r
A flaw was found in jackson-databind before 2.9.10.7. Rated high severity (CVSS 8.1), this vulnerability is remotely exp
Uncontrolled decompression in Apache NiFi 1.5.0 through 2.10.0 exposes the REST API to unauthenticated denial-of-service
Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retriev
The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not ne
When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiF
Authorization bypass in Apache NiFi 1.10.0 through 2.10.0 allows read-only authenticated users to submit Parameter Conte
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to
Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow frami
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today