PT-2026-8394 · Apache · Apache Nifi

David Handermann · Published 2026-02-06 · Updated 2026-02-20 · CVE-2026-25903

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.1.0 through 2.7.2

Description Apache NiFi installations are affected by a missing authorization check when updating configuration properties on extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges needed to add a component to the flow configuration, but the framework did not verify the restricted status during updates to previously added components. This allows a user with lower privileges to modify the configuration of restricted components, potentially compromising dataflow logic or triggering unsafe actions. Installations that do not implement different authorization levels for Restricted components are not affected, as the framework relies on write permissions as a security boundary.

Recommendations Upgrade to Apache NiFi version 2.8.0 to address this issue.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-02444

BIT-NIFI-2026-25903

CVE-2026-25903

GHSA-C5W7-M8WF-XC77

Affected Products

Apache Nifi

References · 22

• https://nvd.nist.gov/vuln/detail/CVE-2026-25903 · Security Note
• https://osv.dev/vulnerability/BIT-nifi-2026-25903 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02444 · Security Note
• https://osv.dev/vulnerability/GHSA-c5w7-m8wf-xc77 · Vendor Advisory
• https://lists.apache.org/thread/jf6bkt9sk6xvshy8xyxv3vtlxd340345 · Vendor Advisory
• https://github.com/apache/nifi · Note
• https://github.com/apache/nifi/commit/119f8881fbc3cbd0d522b0c549b841da3de01f64 · Note
• https://twitter.com/the_yellow_fall/status/2023602153919582288 · Twitter Post
• https://openwall.com/lists/oss-security/2026/02/16/1 · Note
• https://twitter.com/eSecurityPlanet/status/2023870424665252014 · Twitter Post
• https://twitter.com/CCBalert/status/2024130190582940080 · Twitter Post
• https://twitter.com/ksg93rd/status/2024522163496120449 · Twitter Post
• https://t.me/cveNotify/152151 · Telegram Post
• https://twitter.com/threatcluster/status/2023706573038633403 · Twitter Post
• https://twitter.com/ThreatSynop/status/2023690245670093157 · Twitter Post