Authentication Credentials Exposure in Apache NiFi by Apache

CVE-2025-27017

What is CVE-2025-27017?

Apache NiFi versions 1.13.0 through 2.2.0 are susceptible to a vulnerability where authentication credentials for MongoDB are inadvertently included in provenance event records. This exposure occurs when an authorized user with read access to these records can view sensitive information, potentially leading to unauthorized access. For protection against this vulnerability, it is advisable to upgrade to Apache NiFi version 2.3.0, as it addresses this issue by removing sensitive credentials from the provenance event records.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References