CVE-2026-44911

Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed properties override current configuration, enabling users with read access to invoke predefined verification methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying component configuration are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, requiring write access to submit configuration verification requests.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/wrj3t4k2bwd2cztyp078f5kj3722qfzy	Vendor Advisory Mailing List
http://www.openwall.com/lists/oss-security/2026/06/20/4	Third Party Advisory Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) El manejo de la autorización para las solicitudes de verificación de configuración de componentes en Apache NiFi 1.15.0 hasta 2.9.0 permite a los clientes con acceso de lectura enviar propiedades de configuración propuestas. Las propiedades propuestas anulan la configuración actual, permitiendo a los usuarios con acceso de lectura invocar métodos de verificación predefinidos con configuraciones alternativas. Las instalaciones de Apache NiFi que no implementan diferentes niveles de autorización para ver y modificar la configuración de componentes no están sujetas a esta vulnerabilidad. La actualización a Apache NiFi 2.10.0 es la mitigación recomendada, que requiere acceso de escritura para enviar solicitudes de verificación de configuración.

Information

Published : 2026-06-22 08:17

Updated : 2026-10-25 23:10

NVD link : CVE-2026-44911

Mitre link : CVE-2026-44911

CVE.ORG link : CVE-2026-44911

JSON object : View

Products Affected

apache

nifi

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-44911", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44911", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T12:28:06.849874Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 2.3, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:L/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache NiFi", "versions": [{"status": "affected", "version": "1.15.0", "versionType": "semver", "lessThanOrEqual": "2.9.0"}], "packageName": "org.apache.nifi:nifi-web-api", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-06-22T08:17:05.447", "references": [{"url": "https://lists.apache.org/thread/wrj3t4k2bwd2cztyp078f5kj3722qfzy", "tags": ["Vendor Advisory", "Mailing List"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/20/4", "tags": ["Third Party Advisory", "Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed properties override current configuration, enabling users with read access to invoke predefined verification methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying component configuration are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, requiring write access to submit configuration verification requests."}, {"lang": "es", "value": "El manejo de la autorizaci\u00f3n para las solicitudes de verificaci\u00f3n de configuraci\u00f3n de componentes en Apache NiFi 1.15.0 hasta 2.9.0 permite a los clientes con acceso de lectura enviar propiedades de configuraci\u00f3n propuestas. Las propiedades propuestas anulan la configuraci\u00f3n actual, permitiendo a los usuarios con acceso de lectura invocar m\u00e9todos de verificaci\u00f3n predefinidos con configuraciones alternativas. Las instalaciones de Apache NiFi que no implementan diferentes niveles de autorizaci\u00f3n para ver y modificar la configuraci\u00f3n de componentes no est\u00e1n sujetas a esta vulnerabilidad. La actualizaci\u00f3n a Apache NiFi 2.10.0 es la mitigaci\u00f3n recomendada, que requiere acceso de escritura para enviar solicitudes de verificaci\u00f3n de configuraci\u00f3n."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6A7F493-8FA7-4D60-A2D1-70AD8A71A89F", "versionEndExcluding": "2.10.0", "versionStartIncluding": "1.15.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}