CVE-2026-86089

CVE-2026-86089 is a missing-authorization flaw (CWE-862) in Apache NiFi 2.11.0's REST API for migrating version-controlled Process Groups into Connectors: the endpoints that list eligible migration sources and submit migration requests are authorized only against the target Connector, with no check of the source Process Group's access policies. An authenticated attacker with read access to a Connector can enumerate identifiers, names, and flow registry details of Process Groups outside their granted read policies, and with write access to the Connector can migrate such a Process Group, copying its flow definition, referenced assets, and component state into the Connector while leaving the source group disabled and renamed. Exposure is limited because migration excludes sensitive property values and requires the source Process Group to be stopped with empty queues, and installations that do not implement component-level Process Group authorization policies are not affected at all. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation has been reported.

What to do: Upgrade to Apache NiFi 2.12.0, which filters migration sources to Process Groups the requesting user can read and requires write access to the source Process Group for migration requests. Until then, review which users hold read/write access to Connectors and check audit logs for unexpected migration API calls. Deployments that do not use component-level Process Group authorization policies are not affected.