Executive brief
Apache NiFi is a data flow automation tool used to manage and route data across enterprise systems. A vulnerability in NiFi versions 1.5.0 through 2.11.0 allows authenticated users with write access to a Process Group to bypass authorization checks and modify protected components, bind components to unauthorized services, and alter configurations in restricted areas of the system.
Technical details
The vulnerability is an authorization bypass in REST API methods that replace Process Group flow definitions. The affected methods (Process Group flow replacement, versioned flow update, and rebase operations) only check read and write privileges on the target Process Group itself, unlike corresponding asynchronous update request methods which also validate access to encapsulated components, Controller Services, Parameter Contexts, and Parameter Providers. An authenticated user with write access can supply a malicious flow definition to modify or remove components in descendant Process Groups with stricter access policies, or bind components to unauthorized references. The impact is limited to stopped components by existing verification checks, and only affects deployments using component-level authorization policies. Upgrading to Apache NiFi 2.12.0 provides consistent authorization validation across all affected methods.
Affected products
- Apache NiFi 1.5.0 through 2.11.0
Timeline
- 2026-09-16: disclosed: CVE-2026-82561 published