CLEANSTART-2026-FT19254 Security fixes in apache-nifi 2.9.0-r0

Package apache-nifi version 2.9.0-r0 fixes 8 vulnerabilities: CVE-2026-2332, CVE-2026-3505, ghsa-355h-qmc2-wpwf, ghsa-cj8j-37rh-8475, CVE-2026-0636...

CLEANSTART-2026-SP51719 Security fixes in apache-nifi 2.7.2-r7

Package apache-nifi version 2.7.2-r7 fixes 13 vulnerabilities: CVE-2024-29371, CVE-2025-14763, CVE-2025-67721, CVE-2026-22746, CVE-2026-22748...

CLEANSTART-2026-QV23434 Security fixes in apache-nifi 1.25.0-r0

Package apache-nifi version 1.25.0-r0 fixes 4 vulnerabilities: CVE-2025-7962, CVE-2026-5588, CVE-2026-0636, CVE-2026-3505...

CLEANSTART-2026-SM81044 Security fixes in apache-nifi 2.9.0-r1

Package apache-nifi version 2.9.0-r1 fixes 3 vulnerabilities: ghsa-vxf7-qj7q-83fh, ghsa-x2wq-9x2f-fhj7, ghsa-cvc6-q2cp-2xhw...

CLEANSTART-2026-BQ50387 Security fixes in apache-nifi 2.6.0-r3

Package apache-nifi version 2.6.0-r3 fixes 51 vulnerabilities: CVE-2024-29371, CVE-2024-45993, CVE-2025-8671, CVE-2025-11143, CVE-2025-31344...

CLEANSTART-2026-XN05312 Security fixes in apache-nifi 1.25.0-r1

Package apache-nifi version 1.25.0-r1 fixes 3 vulnerabilities: CVE-2024-22257, CVE-2024-38821, CVE-2024-47561...

CLEANSTART-2026-TQ69058 Security fixes in apache-nifi 2.7.2-r0

Package apache-nifi version 2.7.2-r0 fixes 3 vulnerabilities: ghsa-3677-xxcr-wjqv, ghsa-x44p-gvrj-pj2r, ghsa-qqpg-mvqg-649v...

CLEANSTART-2026-HO81161 Security fixes in apache-nifi 2.8.0-r0

Package apache-nifi version 2.8.0-r0 fixes 4 vulnerabilities: ghsa-x2wq-9x2f-fhj7, ghsa-72hv-8253-57qq, ghsa-6v53-7c9g-w56r, ghsa-2m67-wjpj-xhg9...

CLEANSTART-2026-ZG52936 Security fixes in apache-nifi 2.10.0-r1

Package apache-nifi version 2.10.0-r1 fixes 31 vulnerabilities: ghsa-x4gw-5cx5-pgmh, ghsa-3qp7-7mw8-wx86, ghsa-f6hv-jmp6-3vwv, ghsa-c2gf-v879-257j, ghsa-cm33-6792-r9fm...

CLEANSTART-2026-OD16779 Security fixes in apache-nifi 2.9.0-r3

Package apache-nifi version 2.9.0-r3 fixes 55 vulnerabilities: CVE-2024-45993, CVE-2025-31344, CVE-2025-67721, CVE-2025-8671, CVE-2026-10532...

CVE-2026-56740 vulnerabilities

Vulnerabilities for packages: druid, apache-pulsar, kafka, tez, apache-nifi, confluent-kafka, zookeeper...

CVE-2026-56741 vulnerabilities

Vulnerabilities for packages: druid, apache-pulsar, kafka, tez, apache-nifi, confluent-kafka, zookeeper...

GHSA-V3PR-HXPR-MFM8 vulnerabilities

Vulnerabilities for packages: jenkins, hadoop-fips, apache-nifi, guacamole-client...

CVE-2026-47065 vulnerabilities

Vulnerabilities for packages: jenkins, hadoop-fips, apache-nifi, guacamole-client...

CVE-2026-47065 vulnerabilities

Vulnerabilities for packages: apache-nifi, jenkins...

GHSA-V3PR-HXPR-MFM8 vulnerabilities

Vulnerabilities for packages: apache-nifi, jenkins...

BIT-NIFI-2026-54665 Apache NiFi: Missing Validation for Proxy Host Headers

Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application property to restrict values provided in...

BIT-NIFI-2026-44911 Apache NiFi: Incorrect Authorization for Configuration Verification Requests

Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed properties override current configuration, enabling users with read access to invoke predefined...

Apache NiFi fails to validate proxy host headers when constructing qualified URLs

Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application property to restrict values provided in...

Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL

Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not...