CVE-2026-25903: Apache NiFi Web API Component Update Authorization Flaw
Summary
CVE-2026-25903: Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates. Affects org.apache.nifi:nifi-web-api versions >= 1.1.0, < 2.8.0. Fixed in 2.8.0. How to fix ↓
Also tracked for
- nifi · Bitnami
The same CVE-2026-25903 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NiFi is a powerful data integration tool that facilitates the automation of data flow between systems. It allows users to design data flows visually and manage the movement of data in real-time. The NiFi Web API is a critical component that enables programmatic access to NiFi's features. However, certain versions of this API are vulnerable to an authorization issue that can lead to unauthorized changes in component configurations.
Vulnerability Detail
The vulnerability arises from a lack of proper authorization checks when updating configuration properties on extension components that require specific permissions, as indicated by the Restricted annotation. This flaw allows less privileged users to modify properties of components that should only be alterable by users with higher privileges. The implications of this vulnerability can lead to unauthorized access and manipulation of sensitive data flows, potentially compromising the integrity and security of the data managed by Apache NiFi.
How To Fix
Minimum fixed version
2.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider implementing stricter access controls and monitoring to ensure that only authorized users can make changes to component configurations. Regularly audit user permissions and restrict access to sensitive components.
Conclusion
In summary, the CVE-2026-25903 vulnerability in Apache NiFi's Web API poses significant risks due to improper authorization checks for component updates. It is crucial to upgrade to version 2.8.0 or later to mitigate these risks and ensure the security of your data flows.
See every vulnerability recorded for org.apache.nifi:nifi-web-api →
FAQ
Apache NiFi versions 1.1.0 through 2.7.2 are affected by this vulnerability.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability can lead to unauthorized changes in data flow configurations, which may compromise data integrity and security.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by analyzing your pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.nifi:nifi-web-api.
