Executive brief
Apache NiFi is a data flow automation platform used to route and manage data pipelines across enterprise systems. Versions 2.9.0 through 2.11.0 contain a flaw in the REST API endpoints that manage Connector configurations, allowing authenticated users to bypass authorization checks and access secrets they should not be permitted to read. An attacker with limited permissions to modify a Connector could potentially extract sensitive credentials or apply unauthorized configurations, compromising data security and operational integrity.
Technical details
The vulnerability is an authorization bypass in NiFi's Connector configuration update and verification REST API methods. The affected endpoints fail to enforce read authorization checks on Parameter Providers and Asset ownership verification when processing Connector configurations. An authenticated user with write permissions on a Connector can call these API methods to apply Secret values backed by Parameter Providers they should not have read access to, and can reference Assets that do not belong to the Connector being configured. The issue requires the attacker to be authenticated and already authorized to modify the target Connector. Upgrading to Apache NiFi 2.12.0 or later resolves the issue by enforcing read access authorization on referenced Parameter Providers and validating Connector ownership of Assets during configuration operations.
Affected products
- Apache NiFi 2.9.0 through 2.11.0
Timeline
- 2026-09-16: disclosed