CVE-2026-87976: Apache NiFi Registry Path Manipulation Vulnerability
Summary
CVE-2026-87976: Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles. Affects nifi versions >= 0.4.0, < 2.12.0. Fixed in 2.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NiFi Registry is a powerful tool for managing and versioning data flows in Apache NiFi. It allows users to store and manage extension bundles that enhance the functionality of NiFi. The registry supports various features such as version control, collaborative development, and easy deployment of extensions. However, versions 0.4.0 through 2.11.0 are vulnerable to a path manipulation issue that can lead to unauthorized file system access.
Vulnerability Detail
The vulnerability arises from improper limitations on pathname handling when storing extension bundle content. Specifically, the default file persistence provider uses group, artifact, and version coordinates from uploaded NAR manifests as filesystem path components without adequately rejecting parent-directory names. This oversight allows an authenticated user, who has permissions to write and delete bundles in a bucket, to upload a NAR with a crafted manifest. Consequently, this can result in file system operations occurring outside the designated file persistence directory, posing significant security risks.
How To Fix
Minimum fixed version
2.12.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
The CVE-2026-87976 vulnerability in Apache NiFi Registry poses a significant risk due to improper pathname limitations, allowing unauthorized file system access. Users are urged to upgrade to version 2.12.0 or later to secure their installations. Utilizing tools like Vulert can help monitor and identify vulnerabilities in real-time.
See every vulnerability recorded for nifi →
FAQ
Versions 0.4.0 through 2.11.0 of Apache NiFi Registry are affected.
The vulnerability allows authenticated users to perform unauthorized file system operations, potentially leading to data exposure or corruption.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
It is highly recommended to upgrade to Apache NiFi Registry version 2.12.0 or later to mitigate the vulnerability.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for nifi.
