Authorization Flaw in Apache NiFi's Connector Configuration Methods

CVE-2026-81866

What is CVE-2026-81866?

Apache NiFi versions 2.9.0 through 2.11.0 contain an authorization bypass vulnerability within their Connector configuration management. Specifically, the REST API methods for updating and verifying Connector configurations fail to appropriately enforce authorization checks on referenced Assets and Secrets. As a result, an authenticated user, who may have limited privileges to modify a Connector, can access and apply sensitive Secret values sourced from an unauthorized Parameter Provider. Additionally, the configuration methods do not validate that the Assets referenced belong to the Connector being modified. This flaw underscores the importance of implementing robust authorization measures across all components, particularly in configurations, to mitigate risks. The recommended fix is to upgrade to Apache NiFi version 2.12.0 or later, which introduces necessary restrictions ensuring that only authorized users can access and configure these sensitive references.

References