Apache NiFi up to 2.7.2 Component Update authorization

Summaryinfo

A vulnerability, which was classified as critical, has been found in Apache NiFi up to 2.7.2. The impacted element is an unknown function of the component Component Update Handler. Performing a manipulation results in authorization. This vulnerability is identified as CVE-2026-25903. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Apache NiFi up to 2.7.2. This affects an unknown functionality of the component Component Update Handler. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required to add the annotated component to the flow configuration, but framework authorization did not check restricted status when updating a component previously added. The missing authorization requires a more privileged user to add a restricted component to the flow configuration, but permits a less privileged user to make property configuration changes. Apache NiFi installations that do not implement different levels of authorization for Restricted components are not subject to this vulnerability because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.8.0 is the recommended mitigation.

The advisory is shared at seclists.org. This vulnerability is uniquely identified as CVE-2026-25903. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 03/30/2026).

Upgrading to version 2.8.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-0430). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Apache Nifi

Productinfo

Vendor

• Apache

Name

• NiFi

Version

• 2.7.0
• 2.7.1
• 2.7.2

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion