Apache Nifi vulnerabilities

CVE-2018-1310 [HIGH] CVE-2018-1310: Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS conten Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS content could cause denial of service. See ActiveMQ CVE-2015-5254 announcement for more information. The fix to upgrade the activemq-client library to 5.15.3 was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropria

CVE-2021-44145 [MEDIUM] CWE-200 CVE-2021-44145: In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

CVE-2017-7667 [HIGH] CWE-346 CVE-2017-7667: Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin.

CVE-2018-17192 [MEDIUM] CWE-1021 CVE-2018-17192: The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplica The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results incorrectly, allowing clickjacking attacks. Mitigation: The fix to consistently apply the security headers was applied on the Apache NiFi 1.8.0 release. Users running a prior

CVE-2019-10083 [MEDIUM] CWE-200 CVE-2019-10083: When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the reque When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.

CVE-2026-54665 [MEDIUM] CWE-346 CVE-2026-54665: Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request hea Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application property to restrict values provided in the HTTP Host header, but did not apply the validation

CVE-2020-1928 [MEDIUM] CWE-532 CVE-2020-1928: An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter par An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.

CVE-2017-7665 [MEDIUM] CWE-79 CVE-2017-7665: In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient.

CVE-2020-13940 [MEDIUM] CWE-611 CVE-2020-13940: In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and u In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).

CVE-2020-1933 [MEDIUM] CWE-79 CVE-2020-1933: A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers.

CVE-2026-81866 [MEDIUM] CWE-862 CVE-2026-81866: Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API me Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets and Secrets referenced in proposed configuration. Updating or verifying a Connector configuration step can apply Asset and Secret references, but framework authorization was limited to write p

CVE-2026-62354 [MEDIUM] CWE-863 CVE-2026-62354: Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10. Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation methods with alternative settings. Apache NiFi install

CVE-2023-49145 [MEDIUM] CWE-79 CVE-2023-49145: Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary JavaScript code can be executed within the

CVE-2024-52067 [MEDIUM] CWE-532 CVE-2024-52067: Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Pa Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causing the application to write Parameter names and values

CVE-2018-17193 [MEDIUM] CWE-79 CVE-2018-17193: The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected XSS attack. Mitigation: The fix to correctly parse and sanitize the request attribute value was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate releas

CVE-2016-8748 [MEDIUM] CWE-79 CVE-2016-8748: In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.

CVE-2024-45477 [MEDIUM] CWE-79 CVE-2024-45477: Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Para Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session co

CVE-2022-26850 [MEDIUM] CWE-668 CVE-2022-26850: When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory has global read permissions. NiFi immediately moved the temporary file to the final configuration directory, which

CVE-2017-15703 [MEDIUM] CWE-502 CVE-2017-15703: Any authenticated user (valid client certificate but without ACL permissions) could upload a templat Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and caused a denial of service via Java deserialization attack. The fix to properly handle Java deserialization was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appr