Authorization Flaw in Apache NiFi Process Group Management

CVE-2026-86089

What is CVE-2026-86089?

The Apache NiFi framework contains a vulnerability where an authenticated user can exploit a lack of authorization checks in the REST API for migrating version-controlled Process Groups. This oversight permits users with basic read access to enumerate sensitive details of Process Groups and allows those with write access to migrate Process Groups without the necessary permissions. As a result, it poses a risk of exposing sensitive configurations and improper process management. To secure your environment, upgrading to version 2.12.0 is recommended, as it implements robust filtering for migration requests and ensures that only authorized users can perform sensitive actions.

References