CVE-2026-25903
mediumPriorität · verfolgen · 26OT-Risiko · erhöhtEPSS 0.008 · 55. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required to add the annotated component to the flow configuration, but framework authorization did not check restricted status when updating a component previously added. The missing authorization requires a more privileged user to add a restricted component to the flow configuration, but permits a less privileged user to make property configuration changes. Apache NiFi installations that do not implement different levels of authorization for Restricted components are not subject to this vulnerability because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.8.0 is the recommended mitigation.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5.6–8.7
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (7)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2026-0430Apache Nifi: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2026-02-16csaf · cert_bundDE
Ein Angreifer kann eine Schwachstelle in Apache Nifi ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
- GHSA-c5w7-m8wf-xc77Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates2026-02-17ghsa · osvUS
Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required to add the annotated component to the flow configuration, but framework authorization did not check restricted status when updating a component previously added. The missing authorization requires a more privileged user to add a restricted component to the flow configuration, but permits a less privileged user to make property configuration changes. Apache NiFi installations that do not implement different levels of authorization for Restricted components are not subject to this vulnerability because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.8.0 is the recommended mitigation.
- BIT-nifi-2026-25903Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates2026-02-20vendor · osvUS
Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required to add the annotated component to the flow configuration, but framework authorization did not check restricted status when updating a component previously added. The missing authorization requires a more privileged user to add a restricted component to the flow configuration, but permits a less privileged user to make property configuration changes. Apache NiFi installations that do not implement different levels of authorization for Restricted components are not subject to this vulnerability because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.8.0 is the recommended mitigation.
auch bekannt als (6)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (5)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2026/02/16/1cnnvd
- https://lists.apache.org/thread/jf6bkt9sk6xvshy8xyxv3vtlxd340345cnnvd
- https://lists.apache.org/thread/jf6bkt9sk6xvshy8xyxv3vtlxd340345enisa_euvd
- http://www.openwall.com/lists/oss-security/2026/02/16/1Mailing ListThird Party Advisorynvd
- https://lists.apache.org/thread/jf6bkt9sk6xvshy8xyxv3vtlxd340345Mailing ListVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan