Apache Software Foundation Apache Nifi vulnerabilities

CVE-2023-36542 [HIGH] CWE-94 CVE-2023-36542: Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL re Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration

CVE-2023-34468 [HIGH] CWE-94 CVE-2023-34468: The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1 The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC locations. You are recommended to upgrade to version 1.22.

CVE-2015-5254 [CRITICAL] CWE-20 CVE-2015-5254: Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

CVE-2022-33140 [HIGH] CWE-78 CVE-2022-33140: The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 t The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is not included in the default configuration. Command injection requires ShellU

CVE-2026-39816 [HIGH] CWE-862 CVE-2026-39816: The optional extension component TinkerpopClientService is missing the Restricted annotation with th The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the qu

CVE-2024-56512 [MEDIUM] CWE-638 CVE-2024-56512: Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Conte Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases where the Process Group did not reference any Parameter v

CVE-2017-15697 [CRITICAL] CWE-20 CVE-2017-15697: A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedd A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

CVE-2018-1309 [CRITICAL] CWE-611 CVE-2018-1309: Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause infor Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

CVE-2025-66524 [HIGH] CWE-502 CVE-2025-66524: Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration wi Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for storing and retrieving state information. The GetAsanaObject Processor used generic Java Object serialization and deserialization without filtering. Unfiltered Java object deserialization does no

CVE-2017-5636 [CRITICAL] CWE-74 CVE-2017-5636: In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serializa In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node.

CVE-2026-44914 [HIGH] CWE-862 CVE-2026-44914: Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that includ Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required, but framework authorization did not check restricted status when handling requests to repla

CVE-2026-44913 [HIGH] CWE-116 CVE-2026-44913: Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache N Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not cover additional strategies. Apache NiFi installations tha

CVE-2022-29265 [HIGH] CWE-611 CVE-2022-29265: Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when viewing formatted XML files. The following Processors attempt to resolve XML External Entity references when configured with default

CVE-2023-22832 [HIGH] CWE-611 CVE-2023-22832: The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML Extern The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Dec

CVE-2026-44911 [MEDIUM] CWE-863 CVE-2026-44911: Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 throu Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed properties override current configuration, enabling users with read access to invoke predefined verification methods with alternative settings. Apache N

CVE-2017-5635 [HIGH] CWE-287 CVE-2017-5635: In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user requ In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user.

CVE-2017-12632 [HIGH] CWE-20 CVE-2017-12632: A malicious host header in an incoming HTTP request could cause NiFi to load resources from an exter A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to a controlled whitelist was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.

CVE-2024-37389 [MEDIUM] CWE-79 CVE-2024-37389: Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the P Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code, which the client browser will execute within the session context of the

CVE-2023-40037 [MEDIUM] CWE-184 CVE-2023-40037: Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Control Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL validation using custom input formatting. The resolution enhances connection

CVE-2018-17194 [HIGH] CWE-20 CVE-2018-17194: When a client request to a cluster node was replicated to other nodes in the cluster for verificatio When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and eventually timeout. Mitigation: The fix to check DELETE re