CVE-2025-27017: Apache NiFi: Potential Insertion of MongoDB Password in Provenance Record
Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components generate during processing. An authorized user with read access to the provenance events of those processors may see the credentials information. Upgrading to Apache NiFi 2.3.0 is the recommended mitigation, which removes the credentials from provenance event records.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.nifi:nifi-mongodb-servicesto a version that resolves this vulnerability.Fixed in 2.3.0 - Upgrade
Upgrade
Apache NiFito a version that resolves this vulnerability.Fixed in 2.3.0Patch CVE-2025-27017
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27017?
The severity of CVE-2025-27017 is considered high due to the exposure of sensitive MongoDB credentials.
How do I fix CVE-2025-27017?
To fix CVE-2025-27017, upgrade to Apache NiFi version 2.3.0 or later.
What versions of Apache NiFi are affected by CVE-2025-27017?
Apache NiFi versions from 1.13.0 to 2.2.0 are affected by CVE-2025-27017.
Can an unauthorized user exploit CVE-2025-27017?
CVE-2025-27017 requires authorized user access to provenance events, so unauthorized users cannot exploit it directly.
What data is exposed in CVE-2025-27017?
CVE-2025-27017 exposes MongoDB usernames and passwords within NiFi provenance events.