Executive brief
Apache NiFi is a data flow automation and management system used to route, transform, and process data in enterprise environments. In affected versions, users with standard write permissions can bypass security controls to add restricted components that should require elevated privileges, potentially allowing unauthorized access to sensitive data operations. This undermines the intended permission model for sensitive workflow operations.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the framework's Process Group replacement functionality. When handling requests to replace Process Groups, the framework fails to verify the Restricted annotation status of extension components, even though the annotation signals that additional privileges are required. A user with general write access can exploit this by sending a request to replace a Process Group with one containing restricted components, bypassing the intended privilege escalation requirement. This affects versions 1.12.0 through 2.9.0 when Restricted component authorization is implemented. Installations not using Restricted component authorization are unaffected since they rely only on standard write permissions. The fix in version 2.9.0 removes the Restricted component authorization mechanism from the framework itself.
Affected products
- Apache NiFi 1.12.0 through 2.9.0
Timeline
- 2026-06-22: disclosed: Published to GitHub Advisory Database
- 2026-04-27: other: Vulnerability reported
- 2026-04-16: patched: Fix committed in Apache NiFi repository (version 2.9.0)