Skip to content
OpenAdvisories
High WID-SEC-2026-3432 5 CVEs

Apache Nifi: Mehrere Schwachstellen

Published Sep 16, 2026 · Updated Sep 16, 2026 · de-DE

Vendor: Apache Product: Nifi Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Nifi ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten offenzulegen und zu manipulieren oder Denial-of-Service-Zustände herbeizuführen.

Product

Apache Nifi ist ein System zur Verarbeitung und Verteilung von Daten. Es unterstützt skalierbare gerichtete Graphen der Datenweiterleitung, -transformation und Systemvermittlungslogik.

Vulnerabilities 5

  • High 7.5
    CVE-2026-70469

    Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

    Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instance…

    Apache Software Foundation Apache NiFi
  • High 7.2
    CVE-2026-87976

    Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

    Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem p…

    Apache Software Foundation Apache NiFi Registry
  • Medium 5.9
    CVE-2026-82561

    Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods

    Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework…

    Apache Software Foundation Apache NiFi
  • Low 2.3
    CVE-2026-86089

    Apache NiFi: Missing Process Group Authorization for Connector Migration

    Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests. The framework authorized both methods against the target Conne…

    Apache Software Foundation Apache NiFi
  • Low 0.5
    CVE-2026-81866

    Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration

    Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets and Secrets referenced in proposed configuration. Updating or verifying a Connector configuration st…

    Apache Software Foundation Apache NiFi

Revision history

  1. #1

    Initiale Fassung

References