What’s Vulnerable › Products

Apache Software Foundation Apache NiFi vulnerabilities

59 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 20 published in the last 12 months.

Check whether your Apache Software Foundation Apache NiFi version is affected

Latest Apache Software Foundation Apache NiFi vulnerabilities

• CVE-2026-87976 — Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles (CVSS 8.1)
• CVE-2026-86089 — Apache NiFi: Missing Process Group Authorization for Connector Migration (CVSS 7.1)
• CVE-2026-82561 — Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods (CVSS 6.5)
• CVE-2026-81866 — Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration (CVSS 4.3)
• CVE-2026-70469 — Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests (CVSS 7.5)
• CVE-2026-68981 — Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests (CVSS 7.5)
• CVE-2026-68980 — Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion (CVSS 9.1)
• CVE-2026-68979 — Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates (CVSS 9.8)
• CVE-2026-62354 — Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests (CVSS 4.3)
• CVE-2026-54665 — Apache NiFi: Missing Validation for Proxy Host Headers (CVSS 5.3)
• CVE-2026-44914 — Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents (CVSS 7.2)
• CVE-2026-44913 — Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL (CVSS 7.2)
• CVE-2026-44911 — Apache NiFi: Incorrect Authorization for Configuration Verification Requests (CVSS 6.3)
• CVE-2026-39816 — Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService (CVSS 8.8)
• CVE-2026-25903 — Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates (CVSS 6.6)
• CVE-2025-66524 — Apache NiFi: Deserialization of Untrusted Data in GetAsanaObject Processor (CVSS 8.8)
• CVE-2025-27017 — Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record (CVSS 6.5)
• CVE-2024-56512 — Apache NiFi: Missing Complete Authorization for Parameter and Service References (CVSS 5.4)
• CVE-2024-52067 — Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log (CVSS 4.9)
• CVE-2024-45477 — Apache NiFi: Improper Neutralization of Input in Parameter Description (CVSS 4.6)
• CVE-2024-37389 — Apache NiFi: Improper Neutralization of Input in Parameter Context Description (CVSS 5.4)
• CVE-2023-49145 — Apache NiFi: Improper Neutralization of Input in Advanced User Interface for Jolt (CVSS 5.4)
• CVE-2023-40037 — Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs (CVSS 6.5)
• CVE-2023-36542 — Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources (CVSS 8.8)
• CVE-2023-34468 — Apache NiFi: Potential Code Injection with Database Services using H2 (CVSS 8.8)