Executive brief
Apache NiFi is a popular data routing and processing platform used in enterprise data pipelines. When exposed through a reverse proxy, the application can be tricked into constructing URLs pointing to attacker-controlled destinations by injecting malicious proxy host headers in HTTP requests. This could enable phishing attacks or redirect users to malicious sites. The issue affects all versions up to 2.9.0 and is remedied by upgrading to version 2.10.0.
Technical details
The vulnerability stems from an origin validation error (CWE-346) where Apache NiFi builds qualified URLs from HTTP proxy headers without validating their values against the configured allowlist. While version 1.6.0 introduced the nifi.web.proxy.host property to restrict the standard Host header, this validation was not extended to alternative headers (X-ProxyHost and X-Forwarded-Host) used in reverse proxy scenarios. An unauthenticated attacker with network access can inject arbitrary values into these headers, causing the application to construct invalid URLs for HTTP redirects or embedded data references. The fix in version 2.10.0 applies the same validation logic to proxy headers, but requires HTTPS to be enabled for the validation to function. Reverse proxy servers remain responsible for filtering untrusted headers at the edge.
Affected products
- Apache NiFi 0.0.1 through 2.9.0
Timeline
- 2026-06-22: disclosed: Vulnerability published in GitHub Advisory Database
- 2026-06-22: patched: Apache NiFi 2.10.0 released with validation fix