Executive brief
Apache NiFi is a data processing and distribution system used to manage automated data flows between systems. A security flaw in an optional graph database component allows users with low-level access to bypass security restrictions and execute unauthorized code on the server. This could lead to a complete system takeover, data theft, or disruption of critical data pipelines.
Technical details
The TinkerpopClientService extension in Apache NiFi is missing the '@Restricted' annotation for the 'Execute Code' permission. This component supports ByteCode Submission for Script Submission Types, which enables the execution of Groovy scripts prior to query submission. Because the restriction is missing, an authenticated attacker with permissions to configure services—but lacking the explicit 'EXECUTE_CODE' privilege—can configure the service to execute arbitrary code on the NiFi server. This vulnerability specifically affects installations where the optional 'nifi-other-graph-services-nar' bundle is installed and fine-grained authorization is enabled. The issue is resolved in version 2.9.0 by correctly applying the restricted annotation.
Affected products
- Apache NiFi (nifi-other-graph-services-nar) 2.0.0-M1 through 2.8.0
Timeline
- 2026-04-03: disclosed: Vulnerability reported to Apache NiFi maintainers
- 2026-04-06: patched: Fix developed for the component
- 2026-04-10: patched: NiFi 2.9.0 released with the fix
- 2026-05-08: advisory: Public advisory and CVE published