Apache Nifi vulnerabilities

59 CVEs affecting Apache Nifi, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-87976, published 2026-09-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-27223, published 2021-02-26. Medium severity, CVSS 5.3. EPSS: 78% chance of exploitation in the next 30 days. In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q)…
CVE-2023-34468, published 2023-06-12. High severity, CVSS 8.8. EPSS: 61.9% chance of exploitation in the next 30 days. The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver…
CVE-2019-10086, published 2019-08-20. High severity, CVSS 7.3. EPSS: 28.4% chance of exploitation in the next 30 days. In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all…
CVE-2024-37389, published 2024-07-08. Medium severity, CVSS 5.4. EPSS: 24% chance of exploitation in the next 30 days. Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. An authenticated user,…
CVE-2021-20190, published 2021-01-19. High severity, CVSS 8.1. EPSS: 7.6% chance of exploitation in the next 30 days. A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data…
CVE-2017-15697, published 2018-01-23. Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days. A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on…
CVE-2018-1309, published 2018-05-23. Critical severity, CVSS 9.8. EPSS: 4.5% chance of exploitation in the next 30 days. Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and…
CVE-2020-1928, published 2020-01-28. Medium severity, CVSS 5.3. EPSS: 4% chance of exploitation in the next 30 days. An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a…
CVE-2022-33140, published 2022-06-15. High severity, CVSS 8.8. EPSS: 3.8% chance of exploitation in the next 30 days. The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of…
CVE-2017-5636, published 2017-10-19. Critical severity, CVSS 9.8. EPSS: 3.6% chance of exploitation in the next 30 days. In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could…

Latest

CVE-2026-87976, published 2026-09-16. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The…
CVE-2026-86089, published 2026-09-16. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration sources and submit migration requests.…
CVE-2026-82561, published 2026-09-16. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together…
CVE-2026-81866, published 2026-09-16. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets and Secrets referenced in proposed…
CVE-2026-70469, published 2026-09-16. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the standard Content-Encoding header indicating gzip encoding. The…
CVE-2026-68981, published 2026-08-03. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the…
CVE-2026-68980, published 2026-08-03. Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days. Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning…
CVE-2026-68979, published 2026-08-03. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter…
CVE-2026-62354, published 2026-08-03. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override…
CVE-2026-54665, published 2026-06-22. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values…