Which versions of Apache NiFi are affected by CVE-2026-81866?

Apache NiFi versions 2.9.0 through 2.11.0 contain a missing authorization flaw that allows an authenticated user who already holds Connector write privileges to expose Secret values and bind…

How to fix or mitigate CVE-2026-81866?

Within 24 hours, inventory all Apache NiFi instances and confirm which are running versions 2.9.0 through 2.11.0, then determine whether your deployment actually separates authorization levels between Connectors and Parameter Providers - if it does, treat those instances as exposed and immediately audit the current set of users holding Connector write privileges, removing any that are not strictly required. Within 7 days, apply least-privilege tightening to Parameter Providers and Connectors, revoke or rotate any Secret values that reside in Parameter Providers readable only at a higher trust tier than the Connectors referencing them, restrict network and API access to the NiFi REST interface to trusted administrative networks, and enable or review NiFi audit logging for Connector UPDATE and VERIFY calls so anomalous Asset or Secret reference changes are detectable. Within 30 days, monitor the Apache NiFi project and vendor advisory for a fixed release covering the 2.9.0-2.11.0 range and schedule prompt upgrade once available, and in the interim re-validate your authorization model to ensure Connector write permission is not silently granting effective read access to Parameter Provider secrets; note that no vendor-released patch was identified at time of analysis, so compensating controls remain the primary mitigation.

Apache NiFi CVE-2026-81866

Q: What is the CVSS score of CVE-2026-81866?

CVE-2026-81866 has a CVSS 4.0 base score of 0.5 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Clear.

EUVD-2026-81078 LOW

Missing Authorization (CWE-862)

2026-09-16

GHSA-8c35-m833-7pmh

Authentication Bypass Apache

0.5

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

0.5 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Clear

vuln.today AI

5.4 MEDIUM

Remote REST API (AV:N) by an authenticated Connector-writer (PR:L); impact limited to unauthorized use of secrets/assets (C:L/I:L, A:N); real-world risk is lower because it needs non-default tiered authorization, consistent with the vendor's 'Low'.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Sep 16, 2026 - 20:23 NVD

0.5 (LOW)

Analysis Generated

Sep 16, 2026 - 17:06 vuln.today

CVE Published

Sep 16, 2026 - 15:15 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Missing authorization in Apache NiFi 2.9.0 through 2.11.0 allows an authenticated user who already holds write privileges on a Connector to apply Secret and Asset references through the Connector configuration UPDATE and VERIFY REST API methods without the framework verifying that the user may read the backing Parameter Provider or that the Asset actually belongs to the Connector being configured. The result is limited confidentiality and integrity exposure: a user can surface Secret values backed by a Parameter Provider outside their read scope and can bind foreign Asset identifiers to a Connector, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N vector. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires an authenticated NiFi user who already holds write authorization on a Connector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine but low-priority authorization flaw, and the multi-source signals are consistent on that. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade to Apache NiFi 2.12.0, which authorizes read access to referenced Parameter Providers and verifies Connector ownership of referenced Assets during configuration update and verification; this is the recommended and complete mitigation and should be applied to any 2.9.0 through 2.11.0 installation, particularly those running segmented authorization. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Apache NiFi instances and confirm which are running versions 2.9.0 through 2.11.0, then determine whether your deployment actually separates authorization levels between Connectors and Parameter Providers - if it does, treat those instances as exposed and immediately audit the current set of users holding Connector write privileges, removing any that are not strictly required. …

Threat intelligence, references, and detailed analysis are available after sign-in.