CVE-2026-44914: Apache NiFi Web API Missing Authorization Vulnerability
Summary
CVE-2026-44914: Apache NiFi: Missing authorization when replacing Process Groups with restricted components. Affects org.apache.nifi:nifi-web-api versions >= 1.12.0, < 2.9.0. Fixed in 2.9.0. How to fix ↓
Also tracked for
- nifi · Bitnami
The same CVE-2026-44914 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NiFi is a powerful data integration tool that enables the automation of data flows between systems. It offers a web-based interface for designing and monitoring data flows, allowing users to create, manage, and track data pipelines. The NiFi Web API is a critical component that facilitates programmatic access to NiFi's features. However, certain versions of this package are vulnerable to a security flaw that can lead to unauthorized access to restricted components.
Vulnerability Detail
The vulnerability arises from a lack of proper authorization checks when replacing Process Groups that contain components marked with the Restricted annotation. This annotation indicates that additional permissions are required to manage these components. Due to the oversight in the framework's authorization mechanism, users with general write access can inadvertently add or replace components that require elevated privileges. This could lead to unauthorized access to sensitive data or functionality, potentially compromising the integrity and security of the data flows managed by NiFi.
How To Fix
Minimum fixed version
2.9.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, consider implementing custom authorization checks for Restricted components in your NiFi installation to mitigate the risk until you can apply the official patch.
Conclusion
In summary, the missing authorization vulnerability in Apache NiFi's Web API poses a significant risk to users by allowing unauthorized access to restricted components. Upgrading to version 2.9.0 or later is essential to ensure proper authorization checks are in place. Until then, consider implementing custom checks to safeguard your data flows.
See every vulnerability recorded for org.apache.nifi:nifi-web-api →
FAQ
Apache NiFi versions 1.12.0 through 2.8.0 are affected by this vulnerability.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By analyzing your pom.xml file, Vulert can help you identify if your application is affected. You can also use the Vulert playground at Vulert Scanner without any signup.
The potential consequences include unauthorized access to restricted components, which could lead to data breaches or manipulation of sensitive data flows.
Yes, implementing custom authorization checks for Restricted components can help mitigate the risk until you can upgrade to the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.nifi:nifi-web-api.
