CVE-2026-44911

LOW EPSS 24.5%
Published Jun 22, 20261w ago · Modified Jun 23, 20266d ago
2.3 CVSS 4.0
Low
Find Similar
Published Jun 22, 2026 1w ago
Last Modified Jun 23, 2026 6d ago

Description

Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed properties override current configuration, enabling users with read access to invoke predefined verification methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying component configuration are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, requiring write access to submit configuration verification requests.

CVSS Details

Base Score
2.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:L/U:Amber
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
24.5% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-863 Incorrect Authorization Authorization

Affected Products 1

VendorProductVersionRange
apachenifi*≥1.15.0  –  <2.10.0

References 2

  • openwall.com http://www.openwall.com/lists/oss-security/2026/06/20/4
    Third Party AdvisoryMailing List
  • lists.apache.org https://lists.apache.org/thread/wrj3t4k2bwd2cztyp078f5kj3722qfzy
    Vendor AdvisoryMailing List

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.