Executive brief
Apache NiFi is a data flow automation platform used to manage and process data pipelines. In affected versions, read-only users can submit configuration changes through the verification API, allowing them to test and potentially manipulate component settings they should not have permission to modify. While the vulnerability requires valid user credentials and does not directly expose sensitive data, it represents a privilege escalation that bypasses intended access controls and could be combined with other attacks to compromise data pipeline integrity.
Technical details
This is an authorization bypass vulnerability (CWE-863) in the component configuration verification request handler. Read-only users can submit proposed configuration properties that override the current configuration, enabling them to invoke predefined verification methods with alternative settings that they lack write permission to use. The attack requires network access, valid read-level credentials, and low privilege (read access), with no user interaction needed. An attacker can invoke verification methods with unapproved configurations to test payload behavior or bypass intended security constraints. The vulnerability is patched in NiFi 2.10.0, which enforces write-level authorization for configuration verification requests. Installations using fine-grained authorization controls (distinguishing read from write permissions) are affected; those without role-based access control are not vulnerable.
Affected products
- Apache NiFi 1.15.0 through 2.9.0
- Apache nifi-web-api (Maven org.apache.nifi:nifi-web-api) >= 1.15.0, < 2.10.0
Timeline
- 2026-06-22: disclosed: CVE-2026-44911 published
- 2026-04-21: other: Vulnerability reported by Kaixuan Li from Nanyang Technological University
- 2026-05-01: patched: Fix committed (NIFI-15875, PR #11179) - standardized authorization for verify configuration methods
- 2026-09-11: other: GitHub advisory reviewed and finalized