CVE-2026-25903
mediumpriority · track · 26OT risk · elevatedEPSS 0.008 · 55 %ileDEEURUUSEPSS · scored 2026-10-27
Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required to add the annotated component to the flow configuration, but framework authorization did not check restricted status when updating a component previously added. The missing authorization requires a more privileged user to add a restricted component to the flow configuration, but permits a less privileged user to make property configuration changes. Apache NiFi installations that do not implement different levels of authorization for Restricted components are not subject to this vulnerability because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.8.0 is the recommended mitigation.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.6–8.7
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (7)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-0430Apache Nifi: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2026-02-16csaf · cert_bundDE
Ein Angreifer kann eine Schwachstelle in Apache Nifi ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
- GHSA-c5w7-m8wf-xc77Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates2026-02-17ghsa · osvUS
Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required to add the annotated component to the flow configuration, but framework authorization did not check restricted status when updating a component previously added. The missing authorization requires a more privileged user to add a restricted component to the flow configuration, but permits a less privileged user to make property configuration changes. Apache NiFi installations that do not implement different levels of authorization for Restricted components are not subject to this vulnerability because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.8.0 is the recommended mitigation.
- BIT-nifi-2026-25903Apache NiFi: Missing Authorization of Restricted Permissions for Component Updates2026-02-20vendor · osvUS
Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required to add the annotated component to the flow configuration, but framework authorization did not check restricted status when updating a component previously added. The missing authorization requires a more privileged user to add a restricted component to the flow configuration, but permits a less privileged user to make property configuration changes. Apache NiFi installations that do not implement different levels of authorization for Restricted components are not subject to this vulnerability because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.8.0 is the recommended mitigation.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2026/02/16/1cnnvd
- https://lists.apache.org/thread/jf6bkt9sk6xvshy8xyxv3vtlxd340345cnnvd
- https://lists.apache.org/thread/jf6bkt9sk6xvshy8xyxv3vtlxd340345enisa_euvd
- http://www.openwall.com/lists/oss-security/2026/02/16/1Mailing ListThird Party Advisorynvd
- https://lists.apache.org/thread/jf6bkt9sk6xvshy8xyxv3vtlxd340345Mailing ListVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan