CVE-2026-44911— Apache NiFi: Incorrect Authorization for Configuration Verification Requests
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44911
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache NiFi: Incorrect Authorization for Configuration Verification Requests
Source: NVD (National Vulnerability Database)
Vulnerability Description
Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed properties override current configuration, enabling users with read access to invoke predefined verification methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying component configuration are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, requiring write access to submit configuration verification requests.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不正确
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache NiFi | 1.15.0 ~ 2.9.0 | - |
II. Public POCs for CVE-2026-44911
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44911
请登录查看更多情报信息。
Other References for CVE-2026-44911 (1)
Same Patch Batch · Apache Software Foundation · 2026-06-22 · 6 CVEs total
| CVE-2025-62198 | Apache Atlas: Stored XSS in Create Entity page | |
| CVE-2026-44914 | Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents | |
| CVE-2026-44913 | Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL | |
| CVE-2026-54665 | Apache NiFi: Missing Validation for Proxy Host Headers | |
| CVE-2025-66336 | Apache Doris MCP Server: SQL injection leading the authentication bypass |
IV. Related Vulnerabilities
Same product: Apache NiFi
- CVE-2026-44914
Apache NiFi: Missing Authorization of Restricted Permissions - CVE-2026-44913
Apache NiFi: Improper Escaping of Table Names in CaptureChan - CVE-2026-54665
Apache NiFi: Missing Validation for Proxy Host Headers - CVE-2026-39816
Apache NiFi: Missing Execute Code Required Permission on Tin - CVE-2026-25903
Apache NiFi: Missing Authorization of Restricted Permissions
Same vendor: Apache Software Foundation
- CVE-2025-64152
Apache IoTDB: Path Traversal Vulnerability - CVE-2025-55017
Apache IoTDB: Path Traversal Vulnerability - CVE-2026-57915
Apache Kerby: Kerberos Pre-Authentication Bypass - CVE-2026-57914
Apache Kerby: StackOverflow on parsing deeply nested ASN1 st - CVE-2026-49486
Apache Airflow FTP provider: FTP Provider does not protect F
Same weakness: CWE-863
- CVE-2026-9640
LXD Snapshot Import Privilege Escalation Vulnerability - CVE-2026-54091
File Browser: Incorrect access control in public directory s - CVE-2026-54096
File Browser: Improper Access Control Occurs via Pre-Created - CVE-2026-54573
Authorization Bypass in API Key/OAuth Scopes via Path Parsin - CVE-2026-0934
Incorrect Authorization in GitLab
V. Comments for CVE-2026-44911
No comments yet