Authentication Credentials Exposure in Apache NiFi by Apache

CVE-2025-27017

Summary

Apache NiFi versions 1.13.0 through 2.2.0 are susceptible to a vulnerability where authentication credentials for MongoDB are inadvertently included in provenance event records. This exposure occurs when an authorized user with read access to these records can view sensitive information, potentially leading to unauthorized access. For protection against this vulnerability, it is advisable to upgrade to Apache NiFi version 2.3.0, as it addresses this issue by removing sensitive credentials from the provenance event records.

References