EUVD-2026-81076
GHSA-5rjq-rw3w-qr4c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Clear
Network-facing REST API needs an authenticated user with Connector access (PR:L); non-default component-level policy is a precondition not modeled by AC; limited metadata disclosure (C:L) and unauthorized migration/rename (I:L).
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
AnalysisAI
Apache NiFi 2.11.0 does not evaluate Process Group authorization when listing or submitting version-controlled Process Group migrations into a Connector, so an authenticated user holding only Connector-level permissions can reach flows they were never granted policy access to. Read access to a Connector is sufficient to enumerate the identifiers, names, and flow registry details of version-controlled Process Groups outside the user's read policies, while write access to a Connector allows migrating such a group - copying its flow definition, referenced assets, and component state into the Connector and leaving the source group disabled and renamed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) an authenticated NiFi user holding read access (for enumeration) or write access (for migration) to a target Connector, and (2) the installation to be configured with component-level authorization policies for Process Groups - installations that enforce only Connector write permissions as the security boundary are explicitly not vulnerable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-severity authorization flaw, and the available signals are consistent on that. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache NiFi 2.12.0, the fix version recorded against NIFI-16272 and the release that filters migration sources to Process Groups the requester is authorized to read and requires write access to the source Process Group before accepting a migration request - this is the only complete remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify every Apache NiFi 2.11.0 deployment and determine which ones configure component-level authorization policies for Process Groups, since installations without those policies are not affected; inventory all users and groups holding read or write access to Connectors and immediately reduce that access to the smallest set of trusted administrators. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today