PT-2026-51284 · Apache · Apache Nifi

Published 2026-06-22 · Updated 2026-06-22 · CVE-2026-44914

Positive Technologies (AI Summary)

CVSS v4.0

7.5

High

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Clear

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.12.0 through 2.9.0

Description Authorization is missing when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates that additional privileges are required, but the framework failed to check this status when handling requests to replace Process Groups. This allows a user with general write access to add components that have Restricted status. Installations that do not implement specific authorization for Restricted components are not affected, as the framework enforces write permissions as the security boundary.

Recommendations Update to version 2.10.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-44914

Affected Products

Apache Nifi

References · 4

• https://lists.apache.org/thread/ydr34t03xd1n0t9oogpzogjrd5y93838 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44914 · Security Note
• http://openwall.com/lists/oss-security/2026/06/20/6 · Note
• https://twitter.com/canartuc/status/2068994655274852753 · Twitter Post