CVE-2026-44914

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44914
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44914.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44914
Aliases
Downstream
Published
2026-06-22T07:38:01.356Z
Modified
2026-07-08T08:13:29.808687228Z
Severity
  • 7.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/S:P/AU:Y/R:U/V:C/RE:L/U:Clear CVSS Calculator
Summary
Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents
Details

Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required, but framework authorization did not check restricted status when handling requests to replace Process Groups. The missing authorization permits a user with general write access to add components with Restricted status. Apache NiFi installations that do not implement specific authorization for Restricted components are not subject to this vulnerability because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation, which removes the implementation of Restricted status authorization from the framework.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.12.0"
                },
                {
                    "last_affected": "2.9.0"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "1.12.0"
                },
                {
                    "fixed": "2.9.0"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44914.json",
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/apache/nifi

Affected ranges

Type
GIT
Repo
https://github.com/apache/nifi
Events
Introduced
303d6c59ba79b1eed425ee03b807948c7c400e99
Fixed
2baff691128fa782983fb79bb1087adff027a4c1
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.12.0"
        },
        {
            "fixed": "2.10.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44914.json"