Skip to content
OpenAdvisories
High WID-SEC-2026-2029 4 CVEs

Apache Nifi: Mehrere Schwachstellen

Published Jun 21, 2026 · Updated Jun 22, 2026 · Revision 2 · de-DE

Vendor: Apache Product: Nifi Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Nifi ausnutzen, um Dateien und Daten zu manipulieren, um einen SQL-Injection Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.

Product

Apache Nifi ist ein System zur Verarbeitung und Verteilung von Daten. Es unterstützt skalierbare gerichtete Graphen der Datenweiterleitung, -transformation und Systemvermittlungslogik.

Vulnerabilities 4

  • High 7.5
    CVE-2026-44914

    Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents

    Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges require…

    Apache Software Foundation Apache NiFi org.apache.nifi:nifi-web-api Maven
  • Medium 6.3
    CVE-2026-54665

    Apache NiFi: Missing Validation for Proxy Host Headers

    Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application pr…

    Apache Software Foundation Apache NiFi org.apache.nifi:nifi-jetty Maven
  • Medium 5.2
    CVE-2026-44913

    Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL

    Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of poten…

    Apache Software Foundation Apache NiFi org.apache.nifi:nifi-cdc-mysql-processors Maven
  • Low 2.3
    CVE-2026-44911

    Apache NiFi: Incorrect Authorization for Configuration Verification Requests

    Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed properties override current configuration, enabling users wi…

    Apache Software Foundation Apache NiFi org.apache.nifi:nifi-web-api Maven

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-38217, GHSA-CHXJ-GXWW-Q98W, EUVD-2026-38216, EUVD-2026-38219, EUVD-2026-38218, GHSA-QVJ8-GWPM-4X49

  2. #1

    Initiale Fassung

References