GitHub Advisoryadvisory · Maven

GHSA-qvj8-gwpm-4x49 Apache NiFi allows read-only users to submit component configuration verification request

LOW Published 2026-06-22 Modified 2026-09-11 Official page ↗
Aliases
CVE-2026-44911
Ecosystem
Maven
Packages
org.apache.nifi:nifi-web-api
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/AU:Y/R:U/V:C/RE:L/U:Amber
Weaknesses
CWE-863
Reviewed
2026-09-11

Affected packages

• Maven org.apache.nifi:nifi-web-api: >= 1.15.0, < 2.10.0 → fixed in 2.10.0

Description

Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed properties override current configuration, enabling users with read access to invoke predefined verification methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying component configuration are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, requiring write access to submit configuration verification requests.

Related

Alias · CVE (1)

  • CVE-2026-44911 Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References