CVE-2023-40037

CVE-2023-40037: Incomplete Validation of JDBC and JNDI Connection URLs in Apache NiFi Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs...

asf__nifi_CVE-2023-36542_1-22-0

Apache NiFi Status Resources Contacts !Track Issueshttps://img...

CVE-2023-34468

CVE-2023-34468: Remote Code Execution via DB Components in Apache NiFi The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code...

My-Exploits

My-Exploits Vulnerability research I have done on four widely deployed platform services: Keycloak, Apache NiFi, HashiCorp Vault and HashiCorp Nomad. For each finding this repo carries the write-once artifacts I actually use, a Metasploit module where it made sense, a standalone Python proof of...

asf__nifi_CVE-2023-34468_1-21-00

Apache NiFi は、データの処理と配布を簡単かつ強力かつ信頼性高く行うためのシステムです。 目次 機能 推奨環境 はじめに MiNiFi サブプロジェクト Registry サブプロジェクト ヘルプ ドキュメント ライセンス 輸出規制...

apache__nifi_CVE-2022-33140_1-16-22

Apache NiFi ステータス リソース 連絡先 !Track Issueshttps://img.shields.io...

CVE-2023-34468-PoC

CVE-2023-34468 PoC for Apache NiFi Educational proof-of-concept PoC for CVE-2023-34468 affecting Apache NiFi versions prior to 1.22.0. This repository demonstrates how abuse of H2 JDBC URL configuration can lead to authenticated remote code execution RCE in vulnerable Apache NiFi installations...

Apache NiFi - Information Disclosure

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

CLEANSTART-2026-SV46004 client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap

Security vulnerability affects the apache-nifi package. A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap...

CVE-2023-34468

CVE-2023-34468 — Apache NiFi ExecuteSQL H2 RUNSCRIPT RCE PoC 編集可能なApache NiFi ExecuteSQLプロセッサを悪用し、H2のRUNSCRIPTペイロードを使用してBashリバースシェル経由でリモートコマンド実行を誘発する、短いPythonのPoCです。 認可されたテストおよび研究目的のみに使用してください。所有していない、または明示的なテスト許可を得ていないシステムに対して使用しないでください。 動作概要 root@kitploit: ExecuteSQL processor update - H2...

CLEANSTART-2026-GH43742 Security fix for CVE-2024-45993 applied in: apache-nifi 2.6.0-r3, kafka 4.0.1-r3, kafka-fips 4.0.1-r3, kafka-ui 1.4.2-r5, kogito-apps 10.1.0-r1, logstash-fips 9.2.4-r2, logstash-fips 9.3.1-r0, maven 3.8.9-r0

CVE-2024-45993 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WO51602 Security fix for CVE-2026-22751 applied in: apache-nifi 2.7.2-r7, cloud-config-server 4.1.7-r2, cloud-config-server 4.2.4-r0, cloud-config-server 4.3.2-r2, cloud-config-server 4.3.4-r0, kafka-ui 1.4.2-r6, rundeck 6.0.0-r0

CVE-2026-22751 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UH58256 Security fix for CVE-2026-3505 applied in: apache-nifi 1.25.0-r0, apache-nifi 2.9.0-r0, wildfly 39.0.1-r0

CVE-2026-3505 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-AD78101 Security fix for CVE-2026-33557 applied in: apache-nifi 2.7.2-r7

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-PH37738 Security fix for CVE-2026-47065 applied in: apache-nifi 2.6.0-r3

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-ZL47685 Security fix for CVE-2026-14684 applied in: apache-nifi 2.6.0-r3

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-YI89745 Security fix for CVE-2026-14683 applied in: apache-nifi 2.6.0-r3

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2024-56512-Apache-NiFi-Exploit

NiFiExploit Apache NiFi の CVE-2024-56512 脆弱性を悪用するためのツールです。この脆弱性により、適切に保護されていない API を通じて機密データへの不正アクセスが可能になります。...

nifi-CVE-2026-39816-poc

Apache NiFi CVE-2026-39816 POC CVE-2026-39816 の概念実証デモ。Apache NiFi 2.8.0 における EXECUTECODE 権限バイパスで、コード実行権限を意図的に拒否されたフローデザイナーが、 グラフバンドルの ExecuteGraphQuery プロセッサを介して NiFi JVM 内で 任意の Groovy を実行できるようになります。 NiFi 2.9.0 で修正済み ZeroPath によって発見 -- 完全な技術解説はこちらで公開されています。 脆弱性 TinkerpopClientService における...

CVE-2026-87976

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...