Apache NiFi vulnerabilities

Latest Apache NiFi CVEs

Newest publication first · page 1 of 2

1. CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests

   Published 2026-08-03

   High·CVSS 8.8 EPSS 0.74%

   Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client t...

2. CVE-2026-68980 Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion

   Published 2026-08-03

   Low·CVSS 2.3 EPSS 0.48%

   Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifi...

3. CVE-2026-62354 Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests

   Published 2026-08-03

   High·CVSS 7.7 EPSS 0.45%

   Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined comp...

4. CVE-2026-68979 Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates

   Published 2026-08-03

   Medium·CVSS 5.9 EPSS 0.81%

   Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework...

5. CVE-2026-25903 Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates

   Published 2026-02-17

   High·CVSS 8.7 EPSS 0.71%

   Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required to add the annot...

6. CVE-2025-66524 Apache NiFi: Deserialization of Untrusted Data in GetAsanaObject Processor

   Published 2025-12-19

   High·CVSS 7.5 EPSS 0.59%

   Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for storing and retrieving state information. The GetAsanaObject Processor used generic Java Object serialization and deserial...

7. CVE-2024-45477 Apache NiFi: Improper Neutralization of Input in Parameter Description

   Published 2024-10-29

   Medium·CVSS 4.6 EPSS 0.75%

   Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary Java...

8. CVE-2024-37389 Apache NiFi: Improper Neutralization of Input in Parameter Context Description

   Published 2024-07-08

   Medium·CVSS 5.4 EPSS 24.0%

   Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user, authorized to configure a Parameter Context, can enter arbitrary JavaScript code,...

9. CVE-2023-49145 Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt

   Published 2023-11-27

   Medium·CVSS 5.4 EPSS 1.2%

   Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a...

10. CVE-2023-40037 Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs

    Published 2023-08-18

    Medium·CVSS 6.5 EPSS 2.1%

    Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass connection URL valid...

11. CVE-2023-36542 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources

    Published 2023-07-29

    High·CVSS 8.8 EPSS 1.9%

    Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Requi...

12. CVE-2023-34212 Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components

    Published 2023-06-12

    Medium·CVSS 6.5 EPSS 2.4%

    The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from...

13. CVE-2023-34468 Apache NiFi: Potential Code Injection with Database Services using H2

    Published 2023-06-12

    High·CVSS 8.8 EPSS 61.9% Framework module Public exploit

    The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and re...

14. CVE-2023-22832 Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes

    Published 2023-02-10

    High·CVSS 7.5 EPSS 1.4%

    The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XM...

15. CVE-2022-33140 Improper Neutralization of Command Elements in Shell User Group Provider

    Published 2022-06-15

    High·CVSS 8.8 EPSS 3.5%

    The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is no...

16. CVE-2022-29265 Improper Restriction of XML External Entity References in Multiple Components

    Published 2022-04-30

    High·CVSS 7.5 EPSS 2.6%

    Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when viewing formatted XML files. The following Processors attemp...

17. CVE-2022-26850 Insufficiently protected credentials

    Published 2022-04-06

    Medium·CVSS 4.3 EPSS 1.5%

    When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory has global read permissions. NiFi immediat...

18. CVE-2021-44145 Apache NiFi information disclosure by XXE

    Published 2021-12-17

    Medium·CVSS 6.5 EPSS 1.8%

    In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

19. CVE-2020-1933 Cross-site scripting in Apache NiFi

    Published 2020-01-28

    Medium·CVSS 6.1 EPSS 2.8%

    A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers.

20. CVE-2020-1928 Apache NiFi Insertion of Sensitive Information into Log File

    Published 2020-01-28

    Medium·CVSS 5.3 EPSS 4.0%

    An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.

21. CVE-2018-17193 Cross site scripting in org.apache.nifi:nifi

    Published 2018-12-19

    Medium·CVSS 6.1 EPSS 2.8%

    The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected XSS attack. Mitigation: The fix to correctly parse and sanitize the request attribute value was applied on the Apache NiFi 1.8.0 release. Us...

22. CVE-2018-17194 Apache NiFi Improper Input Validation vulnerability

    Published 2018-12-19

    High·CVSS 7.5 EPSS 3.0%

    When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait f...

23. CVE-2018-17195 Cleartext Transmission of Sensitive Information in Apache nifi

    Published 2018-12-19

    High·CVSS 7.5 EPSS 0.71%

    The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, s...

24. CVE-2018-17192 Improper Restriction of Rendered UI Layers or Frames in Apache nifif

    Published 2018-12-19

    Medium·CVSS 6.5 EPSS 2.7%

    The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results incorrectly, allowing clickjacking attacks. Mitigation: The fix to consistently apply the security heade...

25. CVE-2018-1309 Improper Restriction of XML External Entity Reference in Apache NiFi

    Published 2018-05-23

    Critical·CVSS 9.8 EPSS 4.4%

    Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.