CVE-2026-44914

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.12.0 through 2.9.0

Description Authorization is missing when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates that additional privileges are required, but the framework failed to check this status when handling requests to replace Process Groups. This allows a user with general write access to add components that have Restricted status. Installations that do not implement specific authorization for Restricted components are not affected, as the framework enforces write permissions as the security boundary.

Recommendations Update to version 2.10.0.