URL Manipulation Vulnerability in Apache NiFi by Apache

CVE-2026-54665

What is CVE-2026-54665?

A vulnerability exists in Apache NiFi that allows for the construction of invalid qualified URLs using unvalidated HTTP request headers. Although a mitigation was introduced in version 1.6.0 for the standard Host header, alternative headers such as X-ProxyHost and X-Forwarded-Host remain unvalidated in prior versions. This oversight allows clients to influence the application's URL generation, potentially leading to misleading data redirection or unintended data access. To safeguard against this vulnerability, it is crucial for users to upgrade to Apache NiFi 2.10.0, which includes enhanced validation for these headers, and to properly configure the application to use HTTPS.

References