Apache NiFi 1.12.0-2.9.0: Missing Auth on Restricted Process Group Replace
CVE-2026-44914 Published on June 22, 2026

Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents
Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required, but framework authorization did not check restricted status when handling requests to replace Process Groups. The missing authorization permits a user with general write access to add components with Restricted status. Apache NiFi installations that do not implement specific authorization for Restricted components are not subject to this vulnerability because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation, which removes the implementation of Restricted status authorization from the framework.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-44914 is exploitable with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
HIGH
User Interaction:
NONE

Timeline

reported

Weakness Type

What is an AuthZ Vulnerability?

The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVE-2026-44914 has been classified to as an AuthZ vulnerability or weakness.


Products Associated with CVE-2026-44914

Want to know whenever a new CVE is published for Apache NiFi? stack.watch will email you.

Apache NiFi
 

Affected Versions

Apache Software Foundation Apache NiFi:

Exploit Probability

EPSS
0.39%
Percentile
31.99%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.