Apache
Apache Nifi: vulnerabilidades y CVE
Apache Nifi tiene 59 vulnerabilidades publicadas, 16 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE59
Últimos 12 meses16
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-87976 | Alta (7.2) | 0.79% | — | 16 sept 2026 | Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence… |
| CVE-2026-86089 | Baja (2.3) | 0.44% | — | 16 sept 2026 | Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests. The framework… |
| CVE-2026-82561 | Media (5.9) | 0.48% | — | 16 sept 2026 | Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow… |
| CVE-2026-81866 | Baja (0.5) | 0.56% | — | 16 sept 2026 | Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets and Secrets referenced in proposed configuration. Updating… |
| CVE-2026-70469 | Alta (7.5) | 0.62% | — | 16 sept 2026 | Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The framework… |
| CVE-2026-68981 | Alta (8.8) | 0.74% | — | 3 ago 2026 | Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload… |
| CVE-2026-68980 | Baja (2.3) | 0.48% | — | 3 ago 2026 | Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using… |
| CVE-2026-68979 | Media (5.9) | 0.81% | — | 3 ago 2026 | Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change… |
| CVE-2026-62354 | Alta (7.7) | 0.45% | — | 3 ago 2026 | Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current… |
| CVE-2026-54665 | Media (6.3) | 0.33% | — | 22 jun 2026 | Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0… |
| CVE-2026-44914 | Alta (7.5) | 0.66% | — | 22 jun 2026 | Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation… |
| CVE-2026-44913 | Media (5.2) | 0.65% | — | 22 jun 2026 | Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in… |
| CVE-2026-44911 | Baja (2.3) | 0.52% | — | 22 jun 2026 | Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed properties override… |
| CVE-2026-39816 | Alta (7.5) | 0.89% | — | 8 may 2026 | The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports… |
| CVE-2026-25903 | Alta (8.7) | 0.62% | — | 17 feb 2026 | Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permissions based on the Restricted annotation. The Restricted… |
| CVE-2025-66524 | Alta (7.5) | 0.51% | — | 19 dic 2025 | Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for storing and retrieving state information. The GetAsanaObject… |
| CVE-2025-27017 | Media (6.9) | 1.2% | — | 12 mar 2025 | Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access… |
| CVE-2024-56512 | Baja (2.1) | 3.1% | — | 28 dic 2024 | Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a… |
| CVE-2024-52067 | Media (6.9) | 0.73% | — | 21 nov 2024 | Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change… |
| CVE-2024-45477 | Media (4.6) | 0.70% | — | 29 oct 2024 | Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user,… |
| CVE-2024-37389 | Media (5.4) | 24% | — | 8 jul 2024 | Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to… |
| CVE-2023-49145 | Media (5.4) | 1.2% | — | 27 nov 2023 | Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is… |
| CVE-2023-40037 | Media (6.5) | 2.1% | — | 18 ago 2023 | Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An… |
| CVE-2023-36542 | Alta (8.8) | 1.9% | — | 29 jul 2023 | Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables… |
| CVE-2023-34468 | Alta (8.8) | 62% | — | 12 jun 2023 | The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom… |
| CVE-2023-34212 | Media (6.5) | 2.4% | — | 12 jun 2023 | The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library… |
| CVE-2023-22832 | Alta (7.5) | 1.4% | — | 10 feb 2023 | The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious… |
| CVE-2022-33140 | Alta (8.8) | 3.7% | — | 15 jun 2022 | The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands… |
| CVE-2022-29265 | Alta (7.5) | 2.6% | — | 30 abr 2022 | Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when… |
| CVE-2022-26850 | Media (4.3) | 1.5% | — | 6 abr 2022 | When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.