org.apache.nifi:nifi-framework-nar (>=1.12.0, <=1.12.1), org.apache.nifi:nifi-jetty (>=1.12.0, <=1.15.3) +3 more potentially affected by CVE-2026-44914 via org.apache.nifi:nifi-web-api (>=1.12.0, <=2.8.0)

org.apache.nifi:nifi-web-api MAVEN version =1.12.0, =1.12.0, =1.12.0, =1.13.0, =1.12.0, =1.12.0, =2.8.0 Source cves: CVE-2026-44914 Source advisory: GHSA-R2G5-993Q-664G...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error in the processing of HTTP request headers, specifically X-ProxyHost and X-Forwarded-Host. An attacker can manipulate the construction of qualified URLs for redirection or data references by supplying crafted valu...

org.apache.nifi:nifi-framework-nar (>=1.3.0, <=1.9.2), org.apache.nifi:nifi-jetty (>=1.3.0, <=1.9.2) potentially affected by CVE-2019-10083 via org.apache.nifi:nifi-web-api (>=1.3.0, <=1.9.2)

org.apache.nifi:nifi-web-api MAVEN version =1.3.0, =1.3.0, =1.3.0, =1.9.2 Source cves: CVE-2019-10083 Source advisory: MEND:CVE-2019-10083...

org.apache.nifi:nifi-cluster-authorization-provider (0.4.1), org.apache.nifi:nifi-framework-cluster (0.4.1) +6 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.4.1)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider 0.4.1 -...

org.apache.nifi:nifi-cluster-authorization-provider (0.2.0-incubating), org.apache.nifi:nifi-framework-cluster (0.2.0-incubating) +6 more potentially affected by CVE-2017-15703 via org.apache.nifi:nifi-framework-cluster-protocol (0.2.0-incubating)

org.apache.nifi:nifi-framework-cluster-protocol MAVEN version 0.2.0-incubating is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-framework-cluster-protocol and may be impacted: - org.apache.nifi:nifi-cluster-authorization-provider...

External Resource Load

nifi-jetty is vulnerable to malicious external resource loads. Using a malicious HOST header, attackers can load malicious resources from external sources...

Cross-site Scripting (XSS)

nifi-jetty is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary JavaScript because the library does have the sufficient response headers to only allow framing from the same origin...