CVE-2026-70469

Apache NiFi version 2.11.0 is vulnerable to a memory exhaustion issue due to improper handling of Content-Encoding headers in HTTP requests for the application REST API. While support for gzip-encoded requests was disabled, the framework enforcement filter failed to check for multiple instances o...

CVE-2026-86089

Apache NiFi 2.11.0 introduced REST API methods to migrate version-controlled Process Groups into a Connector . The authorization check was performed only against the target Connector, not against the source Process Group, allowing an authenticated user with read access to a Connector to enumerate...