GitHub Advisoryadvisory · Maven

GHSA-chxj-gxww-q98w Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL

MEDIUM Published 2026-06-22 Modified 2026-09-14 Official page ↗
Aliases
CVE-2026-44913
Ecosystem
Maven
Packages
org.apache.nifi:nifi-cdc-mysql-processors
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-116
Reviewed
2026-09-14

Affected packages

• Maven org.apache.nifi:nifi-cdc-mysql-processors: >= 1.2.0, < 2.10.0 → fixed in 2.10.0

Description

Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not cover additional strategies. Apache NiFi installations that do not use the CaptureChangeMySQL Processor are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which incorporates more robust identifier escaping.

Related

Alias · CVE (1)

  • CVE-2026-44913 Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for… vulnerability

Weakness · CWE (1)

  • CWE-116 Improper Encoding or Escaping of Output weakness

References