CVE-2026-44913: Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL
Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not cover additional strategies. Apache NiFi installations that do not use the CaptureChangeMySQL Processor are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which incorporates more robust identifier escaping.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache NiFito a version that resolves this vulnerability.Fixed in 2.10.0 - Configuration
Disable or remove all instances of the CaptureChangeMySQL Processor. Installations that do not use the CaptureChangeMySQL Processor are not subject to this vulnerability.
Apache NiFi CaptureChangeMySQL Processor enabled = false
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44913?
The severity of CVE-2026-44913 is classified as medium with a CVSS score of 5.2.
How do I fix CVE-2026-44913?
To mitigate CVE-2026-44913, you should upgrade Apache NiFi to version 2.10.0 or later, which addresses the improper escaping issue.
What does CVE-2026-44913 affect?
CVE-2026-44913 affects the CaptureChangeMySQL Processor in Apache NiFi versions 1.2.0 through 2.9.0.
What kind of attack does CVE-2026-44913 enable?
CVE-2026-44913 allows attackers to inject SQL commands via crafted database table names.
When was CVE-2026-44913 published?
CVE-2026-44913 was published on June 20, 2026.