Executive brief
Apache NiFi's CaptureChangeMySQL processor improperly escapes database table names, allowing attackers with high privileges to inject SQL commands through crafted table naming. This could lead to unauthorized data access, modification, or deletion from the MySQL database connected to NiFi, compromising data integrity and availability. The vulnerability affects NiFi versions 1.2.0 through 2.9.0, and only impacts deployments that actively use the CaptureChangeMySQL processor.
Technical details
This is a SQL injection vulnerability (CWE-116: Improper Encoding or Escaping of Output) in the CaptureChangeMySQL Processor of Apache NiFi versions 1.2.0 through 2.9.0. The processor constructs database queries using table names without proper identifier escaping. Although NiFi 1.8.0 introduced manual quoted boundaries to limit injection scope, this approach was incomplete and did not prevent alternative injection vectors. Exploitation requires high-level privileges within NiFi and the presence of the CaptureChangeMySQL processor configured in the deployment. An attacker can craft malicious table names to inject arbitrary SQL commands, potentially leading to confidentiality, integrity, and availability impacts on the backend MySQL database. The fix, released in Apache NiFi 2.10.0, implements qualified table names and standardized identifier escaping to prevent this class of injection attack.
Affected products
- Apache NiFi 1.2.0 through 2.9.0
Timeline
- 2026-06-22: disclosed: Published to GitHub Advisory Database and disclosed to oss-security mailing list
- 2026-05-05: patched: Fix merged in Apache NiFi 2.10.0 (commit c9fd0be, PR #11206)