SB2026082578 - Multiple vulnerabilities in Apache Nifi

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082578

SB2026082578 - Multiple vulnerabilities in Apache Nifi

Published: August 25, 2026

Security Bulletin ID SB2026082578
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Improper access control (CVE-ID: CVE-2026-44911)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to invoke configuration verification methods with alternative settings.

The vulnerability exists due to improper access control in component configuration verification requests when submitting proposed configuration properties. A remote user can submit crafted configuration properties to invoke configuration verification methods with alternative settings.

Only installations that implement different authorization levels for viewing and modifying component configuration are vulnerable.


2) SQL injection (CVE-ID: CVE-2026-44913)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary SQL commands.

The vulnerability exists due to improper neutralization of special elements used in an SQL command in CaptureChangeMySQL Processor when processing crafted database table names. A remote user can use a specially crafted table name to execute arbitrary SQL commands.

Only Apache NiFi installations using the CaptureChangeMySQL Processor are vulnerable.


3) Missing Authorization (CVE-ID: CVE-2026-44914)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass restricted component authorization.

The vulnerability exists due to improper access control in process group replacement handling in nifi-web-api when replacing process groups that include extension components with restricted status. A remote user can replace a process group containing restricted components to bypass restricted component authorization.

Only installations that implement specific authorization for restricted components are vulnerable.


4) Input validation error (CVE-ID: CVE-2026-54665)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause generation of invalid qualified URLs for redirection or data references.

The vulnerability exists due to improper input validation in proxy and forwarded host header handling when processing HTTP requests with alternative host headers. A remote attacker can supply crafted X-ProxyHost or X-Forwarded-Host header values to cause generation of invalid qualified URLs for redirection or data references.

The issue affects qualified URL construction based on alternative headers used instead of the standard Host header.


Remediation

Install update from vendor's website.

References