CVE-2026-39816

highpriority · attend · 45OT risk · highEPSS 0.008 · 55 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.76% (55th) EPSS

CVSS 8.8 · high

Is it mine?

7 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–8.8

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.16.8mediumAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v4.07.5highCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:I/V:C/RE:L/U:Greensecondary · ENISA EU

v4.07.5highCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:I/V:C/RE:L/U:Greensecondary · security@apache.org

v4.06.6mediumCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:I/V:C/RE:L/U:Greensecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284USCWE-862USCWE-862US

exploits (1)

Public proof-of-concept and weaponised exploit code.

ZeroPathAI/nifi-CVE-2026-39816-pocPOC for CVE-2026-39816 which allows NiFi users without execute code permissions to run arbitrary scriptsPoC · poc_in_github

affected products (7)

Products and version ranges known to be affected.

Apache Nifi <2.9.0all versionscert_bundDE
Apache Nifi< 2.9.0cert_bundDE
Apache Software Foundation Apache NiFi≤ 2.0.0-M1 ≤2.8.0enisa_euvdEU
Apache Software Foundation NiFi2.0.0-M1 → 2.8.0fstec_bduRU
apache nifi2.0.0 → 2.9.0nvdUScpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*
Bitnami nifi2.0.0 → 2.9.0osvUSpkg:bitnami/nifi
Maven org.apache.nifi:nifi-other-graph-services-nar2.0.0-M1 → 2.9.0osvUSpkg:maven/org.apache.nifi/nifi-other-graph-services-nar

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-1077Apache Nifi: Schwachstelle ermöglicht CodeausführungDeutsch2026-04-13csaf · cert_bundDE
Ein Angreifer kann eine Schwachstelle in Apache Nifi ausnutzen, um beliebigen Programmcode auszuführen.
GHSA-2j9m-25xv-mp6rApache NiFi is missing the Restricted annotation with the Execute Code Required Permission2026-05-08ghsa · osvUS
The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.
BIT-nifi-2026-39816Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService2026-05-11vendor · osvUS
The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv cert_bund nvd NVD CVE.org MITRE

published 2026-05-08modified 2026-10-26

references (6)

External citations — patches, advisories, analysis.

https://nifi.apache.org/Patchcnnvd
https://nvd.nist.gov/vuln/detail/CVE-2026-39816 cnnvd
https://lists.apache.org/thread/gh9g7xwvv4l20gzff6q3367snf35ctcb enisa_euvd
http://www.openwall.com/lists/oss-security/2026/04/13/8Mailing ListThird Party Advisorynvd
https://lists.apache.org/thread/gh9g7xwvv4l20gzff6q3367snf35ctcbMailing ListVendor Advisorynvd
https://zeropath.com/blog/nifi-cve-2026-39816-privesc-rce nvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan