CVE-2017-5636: Injection in Apache NiFi

org.apache.nifi:nifi Updated 02 Oct 2025

Summary

17/05/2022

Disclosed on

CVE-2017-5636

CVE

Yes i

Fix available

Critical

Severity

9.8

CVSS Score

CVE-2017-5636: Injection in Apache NiFi. Affects org.apache.nifi:nifi across 2 version ranges.

< 0.7.2 >= 1.0.0, < 1.1.2

Fixed in 0.7.2 or 1.1.2, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache NiFi is an open-source data integration and data flow automation tool. It provides a web-based interface for designing, managing, and monitoring data flows. The tool is widely used in enterprise environments for processing and distributing data across various systems. However, versions before 0.7.2 and 1.x before 1.1.2 in a cluster environment are vulnerable to an injection attack.

Vulnerability Detail

The vulnerability in Apache NiFi allows an attacker to perform an injection attack in a cluster environment. By carefully crafting a username, an attacker can impersonate another user and gain their permissions on a replicated request to another node. This can lead to unauthorized access and potential data breaches. The injection vulnerability is due to improper serialization and deserialization of the proxy chain.

How To Fix

Latest published version: 2.12.0 as of 23 Oct 2026

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 0.7.2 0.7.2
>= 1.0.0, < 1.1.2 1.1.2

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability. Upgrading to the patched versions is the recommended solution.

Conclusion

The injection vulnerability in Apache NiFi can lead to unauthorized access and potential data breaches. It is crucial to upgrade to the patched versions and review the cluster configuration to ensure proper security measures are in place. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for org.apache.nifi:nifi →

FAQ

What is Apache NiFi?

Apache NiFi is an open-source data integration and data flow automation tool used for designing, managing, and monitoring data flows.

What is the impact of this vulnerability?

This vulnerability allows an attacker to impersonate another user and gain their permissions, potentially leading to unauthorized access and data breaches.

Which versions of Apache NiFi are affected?

Versions before 0.7.2 and 1.x before 1.1.2 in a cluster environment are affected by this vulnerability.

How can I fix this vulnerability?

To fix this vulnerability, it is recommended to upgrade to Apache NiFi version 0.7.2 or later for versions before 1.x, and version 1.1.2 or later for versions 1.x.