Which versions of Apache NiFi are affected by CVE-2026-86089?

Apache NiFi 2.11.0 installations that enforce component-level authorization policies on Process Groups contain a permission bypass in which any user with Connector access can enumerate…

How to fix or mitigate CVE-2026-86089?

Within 24 hours, identify every Apache NiFi 2.11.0 deployment and determine which ones configure component-level authorization policies for Process Groups, since installations without those policies are not affected; inventory all users and groups holding read or write access to Connectors and immediately reduce that access to the smallest set of trusted administrators. Within 7 days, review audit and authorization logs for Connector version-control operations - particularly migration submissions and any Process Groups that have been renamed or transitioned to a disabled state - and treat unexplained instances as potential policy bypass incidents requiring escalation; where Connector access cannot be tightly restricted, consider disabling or restricting the Connector/version-control migration capability until remediation is possible. Within 30 days, re-baseline NiFi authorization policies so that Connector-level permissions are not granted independently of the Process Group policies they can reach, validate that migration actions are logged and alerted on, and establish a standing process to track the Apache NiFi security advisories for a fixed release, as no vendor-released patch has been identified at time of analysis and no public exploit code exists at time of analysis.

Apache NiFi CVE-2026-86089

Q: What is the CVSS score of CVE-2026-86089?

CVE-2026-86089 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Clear.

EUVD-2026-81076 LOW

Missing Authorization (CWE-862)

2026-09-16

GHSA-5rjq-rw3w-qr4c

Authentication Bypass Apache

2.3

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Clear

vuln.today AI

5.4 MEDIUM

Network-facing REST API needs an authenticated user with Connector access (PR:L); non-default component-level policy is a precondition not modeled by AC; limited metadata disclosure (C:L) and unauthorized migration/rename (I:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Sep 16, 2026 - 20:23 NVD

2.3 (LOW)

Analysis Generated

Sep 16, 2026 - 17:05 vuln.today

CVE Published

Sep 16, 2026 - 15:19 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Apache NiFi 2.11.0 does not evaluate Process Group authorization when listing or submitting version-controlled Process Group migrations into a Connector, so an authenticated user holding only Connector-level permissions can reach flows they were never granted policy access to. Read access to a Connector is sufficient to enumerate the identifiers, names, and flow registry details of version-controlled Process Groups outside the user's read policies, while write access to a Connector allows migrating such a group - copying its flow definition, referenced assets, and component state into the Connector and leaving the source group disabled and renamed. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires (1) an authenticated NiFi user holding read access (for enumeration) or write access (for migration) to a target Connector, and (2) the installation to be configured with component-level authorization policies for Process Groups - installations that enforce only Connector write permissions as the security boundary are explicitly not vulnerable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuinely low-severity authorization flaw, and the available signals are consistent on that. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Upgrade to Apache NiFi 2.12.0, the fix version recorded against NIFI-16272 and the release that filters migration sources to Process Groups the requester is authorized to read and requires write access to the source Process Group before accepting a migration request - this is the only complete remediation. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify every Apache NiFi 2.11.0 deployment and determine which ones configure component-level authorization policies for Process Groups, since installations without those policies are not affected; inventory all users and groups holding read or write access to Connectors and immediately reduce that access to the smallest set of trusted administrators. …

Threat intelligence, references, and detailed analysis are available after sign-in.