CLEANSTART-2026-MO53029 Security fix for CVE-2026-47885 applied in: apache-nifi 2.10.0-r8

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-IA74897 Security fix for CVE-2026-47888 applied in: apache-nifi 2.10.0-r8

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-LY84438 Security fix for CVE-2026-47889 applied in: apache-nifi 2.10.0-r8

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DC84124 Security fix for CVE-2026-47856 applied in: apache-nifi 2.10.0-r8

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-DR61127 Security fix for CVE-2026-47848 applied in: apache-nifi 2.10.0-r8, elasticsearch 9.5.2-r2

CVE-2026-47848 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HS64071 Security fix for CVE-2026-47845 applied in: apache-nifi 2.10.0-r8

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-YL03926 Security fix for CVE-2026-47874 applied in: apache-nifi 2.10.0-r8

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-GW15046 Security fix for CVE-2026-47843 applied in: apache-nifi 2.10.0-r8

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-CJ91094 Security fix for CVE-2026-41707 applied in: apache-nifi 2.10.0-r8

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-QY38876 Security fix for CVE-2026-47842 applied in: apache-nifi 2.10.0-r8, spring-boot 3.4.13-r3

CVE-2026-47842 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WY50072 Security fix for CVE-2024-22257 applied in: apache-nifi 1.25.0-r1

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-TA16647 Security fix for CVE-2024-38821 applied in: apache-nifi 1.25.0-r1

Security vulnerability affects the apache-nifi package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-87976

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...

CVE-2026-86089

Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests. The framework authorized both methods against the target Connector alone, without evaluating access ...

CVE-2026-82561

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for these methods was...

CVE-2026-81866

Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets and Secrets referenced in proposed configuration. Updating or verifying a Connector configuration step can apply Asset and Secret...

CVE-2026-70469

Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and d...

CVE-2026-70469 Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and d...

CVE-2026-70469

Apache NiFi 2.11.0 introduced a framework enforcement filter that disabled gzip-encoded HTTP requests for the REST API by rejecting the standard Content-Encoding header. However, the filter failed to check for multiple instances of that header and did not reject non-standard identifiers for gzip ...

EUVD-2026-81079

Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework enforcement filter did not check multiple instances of the Content-Encoding header and d...