CVE-2026-54665: Apache NiFi URL redirection via unvalidated proxy headers

CVE-2026-54665 · Severity: medium · CVSS 5.3 · Published 2026-06-22

Apache NiFi is a popular data routing and processing platform used in enterprise data pipelines. When exposed through a reverse proxy, the application can be tricked into constructing URLs pointing to attacker-controlled destinations by injecting malicious proxy host headers in HTTP requests. This could enable phishing attacks or redirect users to malicious sites. The issue affects all versions up to 2.9.0 and is remedied by upgrading to version 2.10.0.

Technologies: Apache Software Foundation NiFi. Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-54665 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54665 being exploited in the wild.
How severe is CVE-2026-54665?
Medium severity, with a CVSS score of 5.3, published 22 June 2026.
Which products and versions are affected?
Apache Software Foundation NiFi 0.0.1 through 2.9.0; org.apache.nifi:nifi-jetty (Maven) < 2.10.0, ECOSYSTEM:introduced=0,fixed=2.10.0.
Is there a fix for CVE-2026-54665?
Yes. org.apache.nifi:nifi-jetty (Maven): upgrade to 2.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54665 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-54665?
Check whether you run Apache Software Foundation NiFi or org.apache.nifi:nifi-jetty (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.nifi:nifi-jetty (Maven): upgrade to 2.10.0 or later
    # set org.apache.nifi:nifi-jetty to 2.10.0 in your pom.xml or build.gradle

Technical details

The vulnerability stems from an origin validation error (CWE-346) where Apache NiFi builds qualified URLs from HTTP proxy headers without validating their values against the configured allowlist. While version 1.6.0 introduced the nifi.web.proxy.host property to restrict the standard Host header, this validation was not extended to alternative headers (X-ProxyHost and X-Forwarded-Host) used in reverse proxy scenarios. An unauthenticated attacker with network access can inject arbitrary values into these headers, causing the application to construct invalid URLs for HTTP redirects or embedded data references. The fix in version 2.10.0 applies the same validation logic to proxy headers, but requires HTTPS to be enabled for the validation to function. Reverse proxy servers remain responsible for filtering untrusted headers at the edge.

Affected products

  • Apache NiFi 0.0.1 through 2.9.0

Identifiers

  • CVE-2026-54665
  • GHSA-8vm2-c32j-mvfr

Timeline

  • 2026-06-22: disclosed: Vulnerability published in GitHub Advisory Database
  • 2026-06-22: patched: Apache NiFi 2.10.0 released with validation fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.