CVE-2026-44911: Apache NiFi: Incorrect Authorization for Configuration Verification Requests
Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed properties override current configuration, enabling users with read access to invoke predefined verification methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying component configuration are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, requiring write access to submit configuration verification requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache NiFito a version that resolves this vulnerability.Fixed in 2.10.0 - Configuration
Configure NiFi access policies so that submitting configuration verification requests requires write-level permissions and ensure distinct authorization levels for viewing versus modifying component configuration (implement separate view and modify privileges). For NiFi versions 1.15.0 through 2.9.0, enforce these policy changes until upgrading to 2.10.0.
Apache NiFi authorization for configuration verification requests / view vs modify component configuration = require write access; separate view and modify privileges
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44911?
The severity of CVE-2026-44911 is classified as low with a CVSS score of 4.0.
How do I fix CVE-2026-44911?
To fix CVE-2026-44911, ensure that proper authorization checks are implemented for configuration verification requests.
What software is affected by CVE-2026-44911?
CVE-2026-44911 affects Apache NiFi versions from 1.15.0 through 2.9.0.
What kind of vulnerability is CVE-2026-44911?
CVE-2026-44911 is an incorrect authorization vulnerability that allows unauthorized changes to configuration properties.
What impact does CVE-2026-44911 have on security?
CVE-2026-44911 can lead to unauthorized configuration changes, which may compromise the integrity of the system.