CVE-2026-44914: Apache NiFi missing authorization in Process Group replacement

CVE-2026-44914 · Severity: high · CVSS 4 · Published 2026-06-22

Apache NiFi is a data flow automation and management system used to route, transform, and process data in enterprise environments. In affected versions, users with standard write permissions can bypass security controls to add restricted components that should require elevated privileges, potentially allowing unauthorized access to sensitive data operations. This undermines the intended permission model for sensitive workflow operations.

Technologies: Apache Software Foundation NiFi, org.apache.nifi:nifi-web-api (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-44914 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44914 being exploited in the wild.
How severe is CVE-2026-44914?
High severity, with a CVSS score of 4, published 22 June 2026.
Which products and versions are affected?
Apache Software Foundation NiFi 1.12.0 through 2.9.0; org.apache.nifi:nifi-web-api (Maven) >= 1.12.0, < 2.9.0, ECOSYSTEM:introduced=1.12.0,fixed=2.9.0.
Is there a fix for CVE-2026-44914?
Yes. org.apache.nifi:nifi-web-api (Maven): upgrade to 2.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44914 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-44914?
Check whether you run Apache Software Foundation NiFi or org.apache.nifi:nifi-web-api (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.nifi:nifi-web-api (Maven): upgrade to 2.9.0 or later
    # set org.apache.nifi:nifi-web-api to 2.9.0 in your pom.xml or build.gradle

Technical details

The vulnerability is a missing authorization check (CWE-862) in the framework's Process Group replacement functionality. When handling requests to replace Process Groups, the framework fails to verify the Restricted annotation status of extension components, even though the annotation signals that additional privileges are required. A user with general write access can exploit this by sending a request to replace a Process Group with one containing restricted components, bypassing the intended privilege escalation requirement. This affects versions 1.12.0 through 2.9.0 when Restricted component authorization is implemented. Installations not using Restricted component authorization are unaffected since they rely only on standard write permissions. The fix in version 2.9.0 removes the Restricted component authorization mechanism from the framework itself.

Affected products

  • Apache NiFi 1.12.0 through 2.9.0

Identifiers

  • CVE-2026-44914
  • GHSA-r2g5-993q-664g

Timeline

  • 2026-06-22: disclosed: Published to GitHub Advisory Database
  • 2026-04-27: other: Vulnerability reported
  • 2026-04-16: patched: Fix committed in Apache NiFi repository (version 2.9.0)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.