Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record

Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials...

org.apache.nifi:nifi-mongodb-processors (>=2.0.0 <=2.2.0), org.apache.nifi:nifi-mongodb-services-nar (>=1.4.0 <=2.2.0) potentially affected by CVE-2025-27017 via org.apache.nifi:nifi-mongodb-services (>=1.13.0 <=2.2.0)

org.apache.nifi:nifi-mongodb-services MAVEN version =1.13.0, =2.0.0, =1.4.0, =2.2.0 Source cves: CVE-2025-27017 Source advisory: SNYK:JAVA-ORGAPACHENIFI-9403308...

Insertion of Sensitive Information into Externally-Accessible File or Directory

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Externally-Accessible File or Directory due to the inclusion of sensitive credentials in provenance events. An attacker with read access to the provenance events can gain unauthorized access to...

org.apache.nifi:nifi-mongodb-processors (>=2.0.0 <=2.2.0), org.apache.nifi:nifi-mongodb-services-nar (>=1.4.0 <=2.2.0) potentially affected by CVE-2025-27017 via org.apache.nifi:nifi-mongodb-services (>=1.13.0 <=2.2.0)

org.apache.nifi:nifi-mongodb-services MAVEN version =1.13.0, =2.0.0, =1.4.0, =2.2.0 Source cves: CVE-2025-27017 Source advisory: OSV:GHSA-35GQ-CVRM-XF94...

GHSA-35GQ-CVRM-XF94 Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record

Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials...

CVE-2025-27017

Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials...

CVE-2025-27017

CVE-2025-27017 affects Apache NiFi releases 1.13.0 through 2.2.0, where the MongoDB authentication credentials (username/password) used by MongoDB components can be included in provenance event records. An authorized user with read access to these provenance events may view the credentials, expos...

CVE-2025-27017 Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record

Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials...

CVE-2025-27017 Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record

Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials...

CVE-2025-27017 Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record

Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials...

PT-2025-11109 · Apache · Apache Nifi

Name of the Vulnerable Software and Affected Versions: Apache NiFi versions 1.13.0 through 2.2.0 Description: The issue concerns the inclusion of sensitive authentication credentials, specifically the username and password used to connect to MongoDB, in the NiFi provenance events generated by...

Apache NiFi 1.17.0 Remote Code Execution

Apache NiFi version 1.17.0 proof of concept remote code execution exploit that takes advantage of a flaw discovered in 2023. ============================================================================================================================================= | Title : Apache NiFi 1.17.0 R...

Apache NiFi 0.0.2 Remote Code Execution

Apache NiFi version 0.0.2 proof of concept remote code execution exploit that takes advantage of a flaw from 2023. ============================================================================================================================================= | Title : Apache NiFi 0.0.2 RCE...

The vulnerability of the Parameter Context component in the Apache NiFi data processing platform allows a hacker to access confidential information.

The vulnerability of the Parameter Context component in the Apache NiFi data processing platform relates to the disclosure of information through registration files. Exploiting this vulnerability may allow attackers to gain access to confidential information...

CVE-2023-34212

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location...

CVE-2023-34468

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC...

CVE-2023-36542

Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission fo...

org.apache.nifi.minifi:minifi-assembly (>=1.22.0 <=1.28.0), org.apache.nifi.minifi:minifi-c2-assembly (>=1.22.0 <=1.28.0) +22 more potentially affected by CVE-2024-52067 via org.apache.nifi:nifi-framework-core (>=1.16.0 <=1.28.0)

org.apache.nifi:nifi-framework-core MAVEN version =1.16.0, =1.22.0, =1.22.0, =1.22.0, =0.1.0, =0.1.0, =1.22.0, =1.22.0, =0.1.0, =0.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.2 and more Source cves: CVE-2024-52067 Source advisory: OSV:GHSA-V3VC-6QCV-4VRX...

Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log

Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causi...

Unauthorized Access

Apache NiFi is vulnerable to Unauthorized Access. The vulnerability is due to missing fine-grained authorization checks during Process Group creation, allowing attackers to access Parameter Contexts, Controller Services, and Parameter Providers without proper permissions...