CVE-2022-26850: Insufficiently Protected Credentials via Insecure Temporary File in org.apache.nifi:nifi-single-user-utils
Summary
CVE-2022-26850: Impact org.apache.nifi.authentication.single.user.writer.StandardLoginCredentialsWriter contains a local information disclosure vulnerability due to writing credentials (username and password) to a file that is readable... Affects org.apache.nifi:nifi-single-user-utils versions < 1.16. Fixed in 1.16. How to fix ↓
Also tracked for
- nifi · Bitnami
The same CVE-2022-26850 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package org.apache.nifi:nifi-single-user-utils is a component of Apache NiFi, an open-source data integration tool that enables the automation of data flow between systems. The nifi-single-user-utils package provides utilities for managing single-user authentication in NiFi. It includes the StandardLoginCredentialsWriter class, which is responsible for writing login credentials (username and password) to a file. However, this package is vulnerable to an insufficiently protected credentials issue due to the insecure handling of temporary files on Unix-like systems. This vulnerability allows other users on the system to access the credentials file and potentially gain unauthorized access to the NiFi instance.
Vulnerability Detail
The vulnerability arises from the creation of an insecure temporary file by the StandardLoginCredentialsWriter class. This file is created in the system's temporary directory, which is shared among all users on Unix-like systems. As a result, any user on the system can read the contents of the file, which includes sensitive login credentials. This vulnerability poses a risk of unauthorized access to the NiFi instance and potential data breaches. The issue has been assigned a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: 2.12.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.16
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can set the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user. This can be done by modifying the startup script or command used to launch the NiFi instance. By specifying a directory with restricted access, the credentials file will only be accessible to the user running the NiFi process, mitigating the risk of unauthorized access.
Conclusion
The vulnerability in org.apache.nifi:nifi-single-user-utils exposes sensitive login credentials to unauthorized users due to the insecure handling of temporary files. To mitigate this risk, it is crucial to upgrade to version 1.16 of the package, which includes a patch for this vulnerability. Additionally, setting the java.io.tmpdir system environment variable to a restricted directory can provide temporary protection. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.nifi:nifi-single-user-utils →
FAQ
The vulnerability allows other users on the system to access the credentials file, potentially leading to unauthorized access to the NiFi instance and sensitive data.
This vulnerability impacts Unix-like systems, as well as very old versions of Mac OSX and Windows, as they share the system temporary directory among all users.
Yes, the vulnerability has been patched in version 1.16 of the org.apache.nifi:nifi-single-user-utils package.
The vulnerability requires access to the system's temporary directory and affects specific versions of the org.apache.nifi:nifi-single-user-utils package.
You can set the java.io.tmpdir system environment variable to a directory exclusively owned by the executing user as a temporary workaround.
