Executive brief
Apache NiFi is a data routing and transformation platform used to move data between systems. A flaw in NiFi 2.11.0 allows authenticated users to bypass access controls on Process Groups (logical containers of data workflows) during migration operations via REST API. An attacker with limited permissions could enumerate sensitive flow definitions they shouldn't access or migrate workflows they don't have permission to modify, potentially exposing operational data and enabling unauthorized workflow changes.
Technical details
The vulnerability is an authorization bypass in Apache NiFi 2.11.0's REST API migration endpoints for Process Groups. When an authenticated user calls REST methods to list migration sources or submit migration requests, the framework only validates permissions on the target Connector, not the source Process Group being migrated. This allows an attacker with read access to a Connector to enumerate Process Group identifiers, names, and registry details outside their authorization scope, or with write access to migrate a Process Group without write permission to it. The attack requires the source Process Group to be stopped with empty queues, and sensitive property values are excluded from migration, limiting exposure. The fix in version 2.12.0 adds Process Group authorization checks on the enumeration and migration endpoints.
Affected products
- Apache NiFi 2.11.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fix available in Apache NiFi 2.12.0