What’s Vulnerable › Vulnerabilities

CVE-2025-27017: Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-12 · updated 2026-06-17
• Weakness: CWE-538

Description

Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials information. Upgrading to Apache NiFi 2.3.0 is the recommended mitigation, which removes the credentials from provenance event records.

Affected products

• Apache Software Foundation Apache NiFi: from 1.13.0 before 2.3.0 — fixed in 2.3.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache NiFi 2.3.0. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/d4n5474jkhp82dvnht13pjtlfx7bhn5q
• http://www.openwall.com/lists/oss-security/2025/03/11/1

Get alerted when CVE-2025-27017 or the next vulnerability affects your stack