EUVD-2026-81077
GHSA-hfp7-cf28-6f6q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Clear
Authenticated REST API user with Process-Group write (PR:L, AV:N); crosses into more-restrictively-policed components (S:C); integrity-centric (I:H) with limited disclosure (C:L) and stopped-component-only availability effect (A:L).
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
AnalysisAI
Apache NiFi 1.5.0 through 2.11.0 expose REST API methods for replacing an entire Process Group's contents (flow replacement plus versioned-flow update and rebase) that enforce only read/write privileges on the target Process Group, while the parallel asynchronous update methods additionally authorize every component encapsulated in the flow plus referenced Controller Services, Parameter Contexts, and Parameter Providers. An authenticated user holding write access to one Process Group (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L) can therefore submit a crafted flow definition that modifies or deletes components in descendant Process Groups governed by more restrictive policies, or binds components to referenced services and contexts they are not authorized to use. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an authenticated NiFi user account holding write access to at least one Process Group; (2) the deployment must use component-level (fine-grained) authorization policies - deployments relying only on coarse Process-Group read/write policies are NOT affected because write permission is the intended boundary there; and (3) impact is limited to STOPPED components due to existing verification checks. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a broken-access-control / missing-authorization flaw (CWE-862) in Apache NiFi's REST API flow-replacement and versioned-flow-update/rebase methods. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Apache NiFi 2.12.0, which applies consistent reference resolution and component authorization across Process Group replacement and versioned flow update/rebase operations and is the officially recommended mitigation per the oss-security advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache NiFi instances running versions 1.5.0 through 2.11.0, identify every authenticated user with write access to any Process Group, and immediately restrict that write access to trusted administrators where operationally viable; review NiFi audit logs for unexpected flow-replacement, versioned-flow update, or rebase activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today