Unencrypted passwords in Apache NIFI
Summary
GHSA-q594-2475-8v9f: Unencrypted passwords. Affects org.apache.nifi:nifi-standard-processors versions < 0.4.0. Fixed in 0.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache NIFI is an open-source data integration tool that enables the automation of data flow between different systems. It provides a web-based interface for designing and managing data flows. The 'org.apache.nifi:nifi-standard-processors' package is a collection of standard processors that can be used in NIFI data flows. These processors perform various tasks such as data transformation, routing, and integration with external systems.
Vulnerability Detail
The vulnerability found in Apache NIFI before v0.4.0-RC2 involves the storage of passwords in an unencrypted format. Specifically, the passwords of the InvokeHTTP processor were not properly encrypted. This means that if an attacker gains access to the NIFI configuration files or database, they can easily retrieve the passwords in plain text. This vulnerability poses a risk to the confidentiality of sensitive information, as unauthorized individuals can obtain and misuse the passwords.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the latest version of Apache NIFI.
Conclusion
In conclusion, the vulnerability in Apache NIFI involving unencrypted passwords in the InvokeHTTP processor can lead to the exposure of sensitive information. To mitigate this risk, users should upgrade to Apache NIFI version 0.4.0 or later, where the passwords are properly encrypted. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.nifi:nifi-standard-processors →
FAQ
Apache NIFI is an open-source data integration tool that allows the automation of data flow between different systems. It provides a web-based interface for designing and managing data flows.
The 'org.apache.nifi:nifi-standard-processors' package is a collection of standard processors that can be used in Apache NIFI data flows. These processors perform various tasks such as data transformation, routing, and integration with external systems.
The use of unencrypted passwords in Apache NIFI poses a risk to the confidentiality of sensitive information. If an attacker gains access to the NIFI configuration files or database, they can easily retrieve the passwords in plain text and misuse them.
To fix this vulnerability, it is recommended to upgrade to Apache NIFI version 0.4.0 or later. In this version, the passwords of the InvokeHTTP processor are properly encrypted, ensuring the confidentiality of sensitive information.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the latest version of Apache NIFI.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.nifi:nifi-standard-processors.
