CVE-2026-44913: Apache NiFi SQL injection in CaptureChangeMySQL Processor

CVE-2026-44913 · Severity: high · CVSS 7.2 · Published 2026-06-22

Apache NiFi's CaptureChangeMySQL processor improperly escapes database table names, allowing attackers with high privileges to inject SQL commands through crafted table naming. This could lead to unauthorized data access, modification, or deletion from the MySQL database connected to NiFi, compromising data integrity and availability. The vulnerability affects NiFi versions 1.2.0 through 2.9.0, and only impacts deployments that actively use the CaptureChangeMySQL processor.

Technologies: Apache Software Foundation NiFi. Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-44913 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44913 being exploited in the wild.
How severe is CVE-2026-44913?
High severity, with a CVSS score of 7.2, published 22 June 2026.
Which products and versions are affected?
Apache Software Foundation NiFi 1.2.0 through 2.9.0; org.apache.nifi:nifi-cdc-mysql-processors (Maven) >= 1.2.0, < 2.10.0, ECOSYSTEM:introduced=1.2.0,fixed=2.10.0.
Is there a fix for CVE-2026-44913?
Yes. org.apache.nifi:nifi-cdc-mysql-processors (Maven): upgrade to 2.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44913 attacked?
It is attacked over the network.
Am I affected by CVE-2026-44913?
Check whether you run Apache Software Foundation NiFi or org.apache.nifi:nifi-cdc-mysql-processors (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.nifi:nifi-cdc-mysql-processors (Maven): upgrade to 2.10.0 or later
    # set org.apache.nifi:nifi-cdc-mysql-processors to 2.10.0 in your pom.xml or build.gradle

Technical details

This is a SQL injection vulnerability (CWE-116: Improper Encoding or Escaping of Output) in the CaptureChangeMySQL Processor of Apache NiFi versions 1.2.0 through 2.9.0. The processor constructs database queries using table names without proper identifier escaping. Although NiFi 1.8.0 introduced manual quoted boundaries to limit injection scope, this approach was incomplete and did not prevent alternative injection vectors. Exploitation requires high-level privileges within NiFi and the presence of the CaptureChangeMySQL processor configured in the deployment. An attacker can craft malicious table names to inject arbitrary SQL commands, potentially leading to confidentiality, integrity, and availability impacts on the backend MySQL database. The fix, released in Apache NiFi 2.10.0, implements qualified table names and standardized identifier escaping to prevent this class of injection attack.

Affected products

  • Apache NiFi 1.2.0 through 2.9.0

Identifiers

  • CVE-2026-44913
  • GHSA-chxj-gxww-q98w

Timeline

  • 2026-06-22: disclosed: Published to GitHub Advisory Database and disclosed to oss-security mailing list
  • 2026-05-05: patched: Fix merged in Apache NiFi 2.10.0 (commit c9fd0be, PR #11206)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.