CVE-2026-39816: Apache NiFi missing authorization for code execution in TinkerpopClientService

CVE-2026-39816 · Severity: high · CVSS 8.8 · Published 2026-05-08

Apache NiFi is a data processing and distribution system used to manage automated data flows between systems. A security flaw in an optional graph database component allows users with low-level access to bypass security restrictions and execute unauthorized code on the server. This could lead to a complete system takeover, data theft, or disruption of critical data pipelines.

Technologies: Apache Software Foundation NiFi. Vendors: Apache, Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-39816 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-39816 being exploited in the wild.
How severe is CVE-2026-39816?
High severity, with a CVSS score of 8.8, published 8 May 2026.
Which products and versions are affected?
Apache Software Foundation NiFi 2.0.0-M1 through 2.8.0; org.apache.nifi:nifi-other-graph-services-nar (Maven) >= 2.0.0-M1, <= 2.8.0, ECOSYSTEM:introduced=2.0.0-M1,fixed=2.9.0.
Is there a fix for CVE-2026-39816?
Yes. org.apache.nifi:nifi-other-graph-services-nar (Maven): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39816 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-39816?
Check whether you run Apache Nifi, Apache Software Foundation NiFi or org.apache.nifi:nifi-other-graph-services-nar (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.nifi:nifi-other-graph-services-nar (Maven): upgrade to 2.9.0 or later
    # set org.apache.nifi:nifi-other-graph-services-nar to 2.9.0 in your pom.xml or build.gradle

Technical details

The TinkerpopClientService extension in Apache NiFi is missing the '@Restricted' annotation for the 'Execute Code' permission. This component supports ByteCode Submission for Script Submission Types, which enables the execution of Groovy scripts prior to query submission. Because the restriction is missing, an authenticated attacker with permissions to configure services—but lacking the explicit 'EXECUTE_CODE' privilege—can configure the service to execute arbitrary code on the NiFi server. This vulnerability specifically affects installations where the optional 'nifi-other-graph-services-nar' bundle is installed and fine-grained authorization is enabled. The issue is resolved in version 2.9.0 by correctly applying the restricted annotation.

Affected products

  • Apache NiFi (nifi-other-graph-services-nar) 2.0.0-M1 through 2.8.0

Identifiers

  • CVE-2026-39816
  • GHSA-2j9m-25xv-mp6r

Timeline

  • 2026-04-03: disclosed: Vulnerability reported to Apache NiFi maintainers
  • 2026-04-06: patched: Fix developed for the component
  • 2026-04-10: patched: NiFi 2.9.0 released with the fix
  • 2026-05-08: advisory: Public advisory and CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.