CVE-2026-39816

HIGH EPSS 50.7%
Published May 8, 20261mo ago · Modified Jun 17, 20262w ago
7.5 CVSS 4.0
High
Find Similar
Published May 8, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago

Description

The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.

CVSS Details

Base Score
7.5
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:I/V:C/RE:L/U:Green
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
50.7% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-862 Missing Authorization Authorization

Affected Products 1

VendorProductVersionRange
apachenifi*≥2.0.0  –  <2.9.0

References 3

  • openwall.com http://www.openwall.com/lists/oss-security/2026/04/13/8
    Mailing ListThird Party Advisory
  • lists.apache.org https://lists.apache.org/thread/gh9g7xwvv4l20gzff6q3367snf35ctcb
    Mailing ListVendor Advisory
  • zeropath.com https://zeropath.com/blog/nifi-cve-2026-39816-privesc-rce

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.