Java Object Deserialization Vulnerability in Apache NiFi Versions 1.20.0 to 2.6.0

CVE-2025-66524

What is CVE-2025-66524?

Apache NiFi versions 1.20.0 to 2.6.0 contain a significant vulnerability related to the GetAsanaObject Processor, which relies on a Distribute Map Cache Client Service for state management. This processor utilizes generic Java object serialization and deserialization without adequate filtering, creating a risk for exploitation by adversaries. If a crafted state information is stored in the associated cache server, it could lead to unauthorized access and potential system compromise. Users are strongly advised to upgrade to Apache NiFi 2.7.0, where Java Object serialization has been replaced with more secure JSON serialization. Alternatively, removal of the GetAsanaObject Processor from the nifi-asana-processors-nar bundle will also mitigate the risk.

References