CVE-2026-86089

Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests. The framework authorized both methods against the target Connector alone, without evaluating access ...

CVE-2026-81866

Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets and Secrets referenced in proposed configuration. Updating or verifying a Connector configuration step can apply Asset and Secret...

CVE-2026-70469

Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and d...

CVE-2026-70469

Apache NiFi 2.11.0 contains a vulnerability in its REST API framework enforcement filter related to improper handling of the Content-Encoding header. When NiFi 2.11.0 disabled gzip-encoded request support, the filter failed to account for multiple instances of the Content-Encoding header and did ...

EUVD-2026-81079

Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and d...

CVE-2026-81866 Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration

Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets and Secrets referenced in proposed configuration. Updating or verifying a Connector configuration step can apply Asset and Secret...

CVE-2026-81866

Apache NiFi 2.9.0 through 2.11.0 contain a missing authorization flaw in the Connector configuration update and verification REST API methods . The framework enforced write privileges only on the Connector itself, without verifying read access to referenced Parameter Providers or ownership of ref...

CVE-2026-86089 Apache NiFi: Missing Process Group Authorization for Connector Migration

Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests. The framework authorized both methods against the target Connector alone, without evaluating access ...

EUVD-2026-81076

Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests. The framework authorized both methods against the target Connector alone, without evaluating access ...

CVE-2026-86089

Apache NiFi 2.11.0 contains a missing authorization flaw in the REST API methods used to migrate version-controlled Process Groups into a Connector . Both methods—listing eligible migration sources and submitting migration requests—were authorized only against the target Connector, without checki...

CVE-2026-87976

Apache NiFi Registry versions 0.4.0 through 2.11.0 are vulnerable to path manipulation in the default file persistence provider. When storing extension bundle content, the provider used group, artifact, and version coordinates from uploaded NAR manifests as filesystem path components without reje...

CVE-2026-87976 Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...

EUVD-2026-81075

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...

asf__nifi_CVE-2023-36542_1-22-0

Apache NiFi Estado Recursos Contactos !Track Issueshttps://img...

CVE-2023-34468

Exploit CVE-2023-34468 Resumen Este repositorio proporciona una herramienta de explotación basada en Python para CVE-2023-34468 , una vulnerabilidad crítica de ejecución remota de código CVSS 9.8 en Apache NiFi versiones 0.0.2 a 1.21.0. Permite a usuarios autenticados ejecutar código arbitrario...

apache__nifi_CVE-2022-33140_1-16-22

Apache NiFi Estado Recursos Contactos !Track Issueshttps://img...

Apache NiFi - Information Disclosure

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

asf__nifi_CVE-2023-34468_1-21-00

Apache NiFi es un sistema fácil de usar, potente y confiable para procesar y distribuir datos. Tabla de contenidos Características Requisitos Primeros pasos Subproyecto MiNiFi Subproyecto Registry Ayuda...

CVE-2023-34212

CVE-2023-34212: Deserialización de Java a través de componentes JNDI en Apache NiFi El servicio de controlador JndiJmsConnectionFactoryProvider junto con los procesadores ConsumeJMS y PublishJMS, en Apache NiFi 1.8.0 hasta 1.21.0, permiten a un usuario autenticado y autorizado configurar...

CVE-2023-34468-POC

CVE-2023-34468 — Apache NiFi 1.21.0 RCE PoC Remote Code Execution via H2 Database RUNSCRIPT in Apache NiFi = 1.21.0 Vulnerability Apache NiFi ships with an H2 database JAR bundled by default. The DBCPConnectionPool controller service can be configured to use this H2 driver. H2 supports a RUNSCRIP...