# CVE-2026-44911: Apache NiFi incorrect authorization in component configuration verification

Source: https://junglewise.ai/threats/cve-2026-44911-apache-nifi-incorrect-authorization-in-component-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-44911 · Severity: medium · CVSS 4 · Published 2026-06-22

Apache NiFi is a data flow automation platform used to manage and process data pipelines. In affected versions, read-only users can submit configuration changes through the verification API, allowing them to test and potentially manipulate component settings they should not have permission to modify. While the vulnerability requires valid user credentials and does not directly expose sensitive data, it represents a privilege escalation that bypasses intended access controls and could be combined with other attacks to compromise data pipeline integrity.

Technologies: [Apache Software Foundation NiFi](https://junglewise.ai/threats/technologies/nifi), [org.apache.nifi:nifi-web-api (Maven)](https://junglewise.ai/threats/technologies/org-apache-nifi-nifi-web-api). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-44911 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44911 being exploited in the wild.

**How severe is CVE-2026-44911?** Medium severity, with a CVSS score of 4, published 22 June 2026.

**Which products and versions are affected?** Apache Nifi-Web-Api >= 1.15.0, < 2.10.0; Apache Software Foundation NiFi 1.15.0 through 2.9.0; org.apache.nifi:nifi-web-api (Maven) >= 1.15.0, < 2.10.0, ECOSYSTEM:introduced=1.15.0,fixed=2.10.0.

**Is there a fix for CVE-2026-44911?** Yes. org.apache.nifi:nifi-web-api (Maven): upgrade to 2.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44911 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-44911?** Check whether you run Apache Nifi-Web-Api, Apache Software Foundation NiFi or org.apache.nifi:nifi-web-api (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.apache.nifi:nifi-web-api (Maven): upgrade to 2.10.0 or later

  ```sh
  # set org.apache.nifi:nifi-web-api to 2.10.0 in your pom.xml or build.gradle
  ```


## Technical details

This is an authorization bypass vulnerability (CWE-863) in the component configuration verification request handler. Read-only users can submit proposed configuration properties that override the current configuration, enabling them to invoke predefined verification methods with alternative settings that they lack write permission to use. The attack requires network access, valid read-level credentials, and low privilege (read access), with no user interaction needed. An attacker can invoke verification methods with unapproved configurations to test payload behavior or bypass intended security constraints. The vulnerability is patched in NiFi 2.10.0, which enforces write-level authorization for configuration verification requests. Installations using fine-grained authorization controls (distinguishing read from write permissions) are affected; those without role-based access control are not vulnerable.

## Affected products

- Apache NiFi 1.15.0 through 2.9.0
- Apache nifi-web-api (Maven org.apache.nifi:nifi-web-api) >= 1.15.0, < 2.10.0

## Identifiers

- CVE-2026-44911
- GHSA-qvj8-gwpm-4x49

## Timeline

- 2026-06-22: disclosed: CVE-2026-44911 published
- 2026-04-21: other: Vulnerability reported by Kaixuan Li from Nanyang Technological University
- 2026-05-01: patched: Fix committed (NIFI-15875, PR #11179) - standardized authorization for verify configuration methods
- 2026-09-11: other: GitHub advisory reviewed and finalized

## References

- [https://lists.apache.org/thread/wrj3t4k2bwd2cztyp078f5kj3722qfzy](https://lists.apache.org/thread/wrj3t4k2bwd2cztyp078f5kj3722qfzy)
- [http://www.openwall.com/lists/oss-security/2026/06/20/4](http://www.openwall.com/lists/oss-security/2026/06/20/4)
- [https://github.com/apache/nifi/commit/f30f877fb3e0e2a0db7850be8b6d586203860a45](https://github.com/apache/nifi/commit/f30f877fb3e0e2a0db7850be8b6d586203860a45)

## Related threats

- [Apache NiFi URL redirection via unvalidated proxy headers](https://junglewise.ai/threats/cve-2026-54665-apache-nifi-url-redirection-via-unvalidated-proxy-headers)
- [Apache NiFi missing authorization in Process Group replacement](https://junglewise.ai/threats/cve-2026-44914-apache-nifi-missing-authorization-in-process-group-replacement)
- [Apache NiFi SQL injection in CaptureChangeMySQL Processor](https://junglewise.ai/threats/cve-2026-44913-apache-nifi-sql-injection-in-capturechangemysql-processor)
- [Apache NiFi missing authorization for code execution in TinkerpopClientService](https://junglewise.ai/threats/cve-2026-39816-apache-nifi-missing-authorization-for-code-execution-in)
- [Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates](https://junglewise.ai/threats/cve-2026-25903-apache-nifi-missing-authorization-of-restricted-permissions-for)