PT-2026-51283

CVE-2026-44913

·

Published

2026-06-22

·

Updated

2026-10-10

Description by

CVSS 3.1
9.8
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.2.0 through 2.9.0
Description Improper escaping of database table names in the CaptureChangeMySQL Processor allows for the injection of SQL commands through crafted naming. This issue affects installations utilizing the CaptureChangeMySQL Processor.
Recommendations Update to version 2.10.0. As a temporary mitigation, restrict or disable the use of the CaptureChangeMySQL Processor.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-116: Improper Encoding or Escaping of Output
Related identifiers
CVE-2026-44913
GHSA-CHXJ-GXWW-Q98W
BIT-NIFI-2026-44913
CLEANSTART-2026-AM39668
CLEANSTART-2026-JM42748
CLEANSTART-2026-LP47495
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com