CVE-2026-44913

Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not cover additional strategies. Apache NiFi installations that do not use the CaptureChangeMySQL Processor are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which incorporates more robust identifier escaping.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/c8vkt5rz4dqql6sjxgrr3zdkbt1sfmsl	Vendor Advisory Mailing List
http://www.openwall.com/lists/oss-security/2026/06/20/5	Third Party Advisory Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Escape incorrecto de nombres de tablas de base de datos en el procesador CaptureChangeMySQL incluido con Apache NiFi 1.2.0 hasta 2.9.0 permite la inyección de comandos SQL utilizando nombres manipulados. Delimitadores entre comillas manuales añadidos en Apache NiFi 1.8.0 redujeron el alcance de las opciones de inyección potenciales, pero no cubrieron estrategias adicionales. Las instalaciones de Apache NiFi que no utilizan el procesador CaptureChangeMySQL no están sujetas a esta vulnerabilidad. La actualización a Apache NiFi 2.10.0 es la mitigación recomendada, que incorpora un escape de identificadores más robusto.

Information

Published : 2026-06-22 08:17

Updated : 2026-10-25 23:10

NVD link : CVE-2026-44913

Mitre link : CVE-2026-44913

CVE.ORG link : CVE-2026-44913

JSON object : View

Products Affected

apache

nifi

CWE

CWE-116

Improper Encoding or Escaping of Output

{"id": "CVE-2026-44913", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44913", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T12:28:36.629842Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"Safety": "PRESENT", "version": "4.0", "Recovery": "USER", "baseScore": 5.2, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Clear", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "CLEAR", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache NiFi", "versions": [{"status": "affected", "version": "1.2.0", "versionType": "semver", "lessThanOrEqual": "2.9.0"}], "packageName": "org.apache.nifi:nifi-cdc-mysql-processors", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-06-22T08:17:05.613", "references": [{"url": "https://lists.apache.org/thread/c8vkt5rz4dqql6sjxgrr3zdkbt1sfmsl", "tags": ["Vendor Advisory", "Mailing List"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/20/5", "tags": ["Third Party Advisory", "Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not cover additional strategies. Apache NiFi installations that do not use the CaptureChangeMySQL Processor are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which incorporates more robust identifier escaping."}, {"lang": "es", "value": "Escape incorrecto de nombres de tablas de base de datos en el procesador CaptureChangeMySQL incluido con Apache NiFi 1.2.0 hasta 2.9.0 permite la inyecci\u00f3n de comandos SQL utilizando nombres manipulados. Delimitadores entre comillas manuales a\u00f1adidos en Apache NiFi 1.8.0 redujeron el alcance de las opciones de inyecci\u00f3n potenciales, pero no cubrieron estrategias adicionales. Las instalaciones de Apache NiFi que no utilizan el procesador CaptureChangeMySQL no est\u00e1n sujetas a esta vulnerabilidad. La actualizaci\u00f3n a Apache NiFi 2.10.0 es la mitigaci\u00f3n recomendada, que incorpora un escape de identificadores m\u00e1s robusto."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06ECCD2B-8B33-4D0F-A817-6E3FA426BB5F", "versionEndExcluding": "2.10.0", "versionStartIncluding": "1.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}