Which versions of Apache NiFi are affected by EUVD-2026-38217?

CVE-2026-44913 is a critical SQL injection vulnerability in Apache NiFi's CaptureChangeMySQL Processor (versions 1.2.0-2.9.0) that enables database-privileged attackers to execute arbitrary SQL…. A patch is available.

How to fix or mitigate EUVD-2026-38217?

Within 24 hours: identify all NiFi deployments running versions 1.2.0-2.9.0 with CaptureChangeMySQL Processor active and document their business criticality. Within 7 days: upgrade to Apache NiFi 2.10.0, which contains full remediation of this vulnerability. Within 30 days: implement least-privilege database service credentials, restrict MySQL user privileges to read operations only, and deploy audit logging for all database operations initiated by NiFi.

Apache NiFi EUVD-2026-38217

Q: What is the CVSS score of EUVD-2026-38217?

EUVD-2026-38217 has a CVSS 4.0 base score of 5.2 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Clear. EPSS exploitation probability: 0.3%.

| CVE-2026-44913 MEDIUM

Improper Encoding or Escaping of Output (CWE-116)

2026-06-20

GHSA-chxj-gxww-q98w

Apache Code Injection Nifi

5.2

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.2 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Clear

vuln.today AI

9.9 CRITICAL

Attacker needs network-reachable MySQL with low-privilege CREATE TABLE access; scope change applies because injected SQL executes under NiFi's service account, crossing the security boundary of the vulnerable component.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Jun 22, 2026 - 08:22 NVD

5.2 (MEDIUM)

Analysis Generated

Jun 22, 2026 - 06:24 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

2 maven packages depend on org.apache.nifi:nifi-cdc-mysql-processors (1 direct, 1 indirect)

Ecosystem-wide dependent count for version 1.2.0.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

SQL injection via improperly escaped MySQL table names in Apache NiFi's CaptureChangeMySQL Processor (versions 1.2.0 through 2.9.0) allows an attacker with MySQL CREATE TABLE access in a monitored database to inject arbitrary SQL commands executed under NiFi's MySQL service credentials. A partial mitigation introduced in 1.8.0 added manual quoted boundaries that narrowed - but did not eliminate - the injection surface; the root flaw persisted for years until full remediation in 2.10.0. No public exploit identified at time of analysis and not listed in CISA KEV; the issue was discovered by Roberto Suggi Liverani of the NATO Cyber Security Centre (NCSC) and disclosed in April 2026.

Technical ContextAI

Apache NiFi's CaptureChangeMySQL Processor implements Change Data Capture (CDC) by consuming MySQL binary logs to detect and relay row-level database changes downstream. As part of processing each CDC event, the processor constructs SQL metadata queries against the MySQL instance (e.g., selecting the database, querying table schema) using table names extracted directly from those binary log events. Because MySQL table names are user-controlled artifacts - any account with CREATE TABLE privilege can define them - an attacker can embed SQL metacharacters in a table name. The processor interpolates this name into SQL string construction without adequate identifier quoting or parameterized handling, producing a classic SQL injection condition (analogous to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, and CWE-116: Improper Encoding or Escaping of Output). NiFi 1.8.0 added manual backtick-style quoted boundaries as a partial countermeasure, but this approach did not account for all injection strategies such as quote escaping or alternate delimiter sequences. The fix in 2.10.0, tracked as NIFI-15905 and implemented via GitHub PR #11206, refactors the processor to use properly qualified table name handling with robust identifier escaping throughout. The affected Maven artifact is org.apache.nifi:nifi-cdc-mysql-processors.

RemediationAI

Upgrade to Apache NiFi 2.10.0, the vendor-released patch that incorporates robust SQL identifier escaping in the CaptureChangeMySQL Processor, as confirmed by JIRA NIFI-15905 (resolved 2026-05-05, Fix Version 2.10.0) at https://issues.apache.org/jira/browse/NIFI-15905 and implemented via GitHub PR #11206. If immediate upgrade is not possible, disabling or removing all CaptureChangeMySQL Processor instances from active NiFi flows eliminates the attack surface entirely per the advisory - at the cost of losing MySQL CDC pipeline functionality until upgrade is completed. As a defense-in-depth measure regardless of upgrade status, restrict MySQL CREATE TABLE privileges in databases monitored by NiFi to only fully trusted accounts, and ensure NiFi's MySQL service account is scoped to the minimum CDC-required permissions (REPLICATION CLIENT, REPLICATION SLAVE, SELECT) to limit the impact of any successful injection. Consult the Apache NiFi project site at https://nifi.apache.org/ for upgrade documentation and release notes.