CVE-2026-82561

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.5.0 through 2.11.0

Description Certain REST API methods used for replacing Process Group contents, versioned flow updates, and rebase operations lack sufficient authorization checks. While asynchronous update methods authorize encapsulated components, referenced Controller Services, Parameter Contexts, and Parameter Providers, these specific methods only require read and write privileges on the Process Group itself. This allows an authenticated user with write access to a Process Group to provide a flow definition that modifies or removes components in descendant Process Groups protected by more restrictive policies, or bind components to unauthorized Controller Services and Parameter Contexts. This issue specifically affects deployments using component-level authorization policies and is limited to stopped components.

Recommendations Update to version 2.12.0.