CVE-2026-54665: Apache NiFi: Missing Validation for Proxy Host Headers
Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application property to restrict values provided in the HTTP Host header, but did not apply the validation to alternative Proxy and Forwarded headers. The absence of proxy host header validation allowed a client to instruct Apache NiFi web services to construct invalid qualified URLs for redirection or data references. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which implements validation for the X-ProxyHost and X-Forwarded-Host HTTP request headers based on the nifi.web.proxy.host property. Enabling header validation requires configuring the application with HTTPS. Reverse proxy servers in front of Apache NiFi are responsible for filtering input request headers and providing allowed values to the application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache NiFito a version that resolves this vulnerability.Fixed in 2.10.0 - Configuration
Set the nifi.web.proxy.host property to the list of allowed proxy hostnames so NiFi validates X-ProxyHost and X-Forwarded-Host header values against these hosts.
Apache NiFi nifi.web.proxy.host = comma-separated list of allowed proxy hostnames (set to your reverse proxy hostnames) - Compensating control
Configure reverse proxy servers in front of Apache NiFi to filter and validate incoming Host, X-ProxyHost and X-Forwarded-Host HTTP headers; only forward allowed/expected host header values to NiFi.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54665?
The severity of CVE-2026-54665 is medium with a CVSS score of 6.3.
How do I fix CVE-2026-54665?
To fix CVE-2026-54665, ensure you upgrade to Apache NiFi version 1.6.0 or later, which includes the validation feature for proxy host headers.
What vulnerabilities does CVE-2026-54665 address?
CVE-2026-54665 addresses missing validation for proxy host headers in Apache NiFi versions 0.0.1 through 2.9.0.
Who is affected by CVE-2026-54665?
Apache NiFi users running versions 0.0.1 through 2.9.0 are affected by CVE-2026-54665.
What could happen if CVE-2026-54665 is exploited?
If exploited, CVE-2026-54665 could allow an attacker to manipulate requests by providing unvalidated proxy host headers.