CVE-2026-39816

highPriorität · beachten · 45OT-Risiko · hochEPSS 0.008 · 55. PerzentilExploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.76% (55th) EPSS

CVSS 8.8 · high

Is it mine?

7 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.6–8.8

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 5.9

v3.16.8mediumAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v4.07.5highCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:I/V:C/RE:L/U:Greensecondary · ENISA EU

v4.07.5highCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:I/V:C/RE:L/U:Greensecondary · security@apache.org

v4.06.6mediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:I/V:C/RE:L/U:Greensecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-284USCWE-862USCWE-862US

Exploits (1)

Öffentlicher Proof-of-Concept- und Exploit-Code.

ZeroPathAI/nifi-CVE-2026-39816-pocPOC for CVE-2026-39816 which allows NiFi users without execute code permissions to run arbitrary scriptsPoC · poc_in_github

betroffene Produkte (7)

Betroffene Produkte und Versionsbereiche.

Apache Nifi <2.9.0alle Versionencert_bundDE
Apache Nifi< 2.9.0cert_bundDE
Apache Software Foundation Apache NiFi≤ 2.0.0-M1 ≤2.8.0enisa_euvdEU
Apache Software Foundation NiFi2.0.0-M1 → 2.8.0fstec_bduRU
apache nifi2.0.0 → 2.9.0nvdUScpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*
Bitnami nifi2.0.0 → 2.9.0osvUSpkg:bitnami/nifi
Maven org.apache.nifi:nifi-other-graph-services-nar2.0.0-M1 → 2.9.0osvUSpkg:maven/org.apache.nifi/nifi-other-graph-services-nar

Advisories (3)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2026-1077Apache Nifi: Schwachstelle ermöglicht CodeausführungDeutsch2026-04-13csaf · cert_bundDE
Ein Angreifer kann eine Schwachstelle in Apache Nifi ausnutzen, um beliebigen Programmcode auszuführen.
GHSA-2j9m-25xv-mp6rApache NiFi is missing the Restricted annotation with the Execute Code Required Permission2026-05-08ghsa · osvUS
The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.
BIT-nifi-2026-39816Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService2026-05-11vendor · osvUS
The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

veröffentlicht 2026-05-08geändert 2026-10-26

Referenzen (6)

Externe Belege — Patches, Meldungen, Analysen.

https://nifi.apache.org/Patchcnnvd
https://nvd.nist.gov/vuln/detail/CVE-2026-39816 cnnvd
https://lists.apache.org/thread/gh9g7xwvv4l20gzff6q3367snf35ctcb enisa_euvd
http://www.openwall.com/lists/oss-security/2026/04/13/8Mailing ListThird Party Advisorynvd
https://lists.apache.org/thread/gh9g7xwvv4l20gzff6q3367snf35ctcbMailing ListVendor Advisorynvd
https://zeropath.com/blog/nifi-cve-2026-39816-privesc-rce nvd

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan