CVE-2026-86089: Apache NiFi Connector Migration Process Group Authorization Flaw
Summary
CVE-2026-86089: Apache NiFi: Missing Process Group Authorization for Connector Migration. Affects nifi versions >= 2.11.0, < 2.12.0. Fixed in 2.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NiFi is an open-source data integration tool designed to automate the flow of data between systems. It provides a web-based interface for designing data flows, enabling users to create, monitor, and manage data pipelines. The tool supports version-controlled Process Groups, which allow users to manage complex data flows efficiently. However, a recent vulnerability has been identified in version 2.11.0 that affects the authorization mechanisms for migrating Process Groups into Connectors.
Vulnerability Detail
The vulnerability arises from the lack of proper authorization checks when migrating version-controlled Process Groups into Connectors via REST API methods. Specifically, the framework only checks permissions against the target Connector, neglecting to evaluate access to the involved Process Groups. This oversight allows authenticated users with read access to a Connector to enumerate sensitive details of Process Groups they should not have access to. Additionally, users with write access to a Connector can migrate Process Groups without the necessary permissions, potentially leading to unauthorized data exposure and manipulation.
How To Fix
Minimum fixed version
2.12.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider implementing component-level authorization policies for Process Groups. This will help mitigate the risk by enforcing stricter access controls, preventing unauthorized users from accessing sensitive Process Group information.
Conclusion
In summary, CVE-2026-86089 is a significant vulnerability in Apache NiFi that compromises the authorization process for migrating Process Groups. Upgrading to version 2.12.0 is essential to ensure proper security measures are in place. Users should also consider implementing additional authorization policies as a temporary measure.
See every vulnerability recorded for nifi →
FAQ
CVE-2026-86089 is a vulnerability in Apache NiFi that allows unauthorized access to version-controlled Process Groups during migration to Connectors.
Any user with read or write access to a Connector in Apache NiFi version 2.11.0 is potentially affected by this vulnerability.
The risks include unauthorized enumeration of sensitive Process Group details and the ability to migrate Process Groups without proper permissions, leading to potential data exposure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement component-level authorization policies for Process Groups to limit access and mitigate the risks until you can upgrade to a patched version.
Related vulnerabilities
Recent vulnerabilities recorded for nifi.
