CVE-2026-86089: Apache NiFi: Missing Process Group Authorization for Connector Migration
Apache NiFi 2.11.0 Connector Migration REST APIs authorize only against the target Connector, skipping Process Group access checks (CVE-2026-86089, Low).
24
Product
Apache NiFi
- Mentions · 7d0
- Mentions · 30d0
- All mentions4
- First seenSep 16, 2026
- Last mentionedSep 16, 2026
Timeline
4 articles · newest firstCVE-2026-82561: Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods
Apache NiFi 1.5.0-2.11.0 flow update REST methods lack authorization checks for referenced components, permitting unauthorized Process Group flow replacement (CVE-2026-82561).
38
CVE-2026-81866: Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration
Apache NiFi 2.9.0-2.11.0 Connector configuration update and verification APIs skip authorization for referenced Assets and Secrets (CVE-2026-81866, Low).
24
CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests
Apache NiFi CVE-2026-70469: duplicate or non-standard Content-Encoding headers bypass gzip request filtering in NiFi 2.11.0's REST API.
45
Related CVEs
by mentions- Memory-exhaustion DoS via crafted Content-Encoding headers in Apache NiFi 2.11.0
- Missing Authorization in Apache NiFi Process Group Flow Update REST API
- Missing Authorization in Apache NiFi Connector Migration Exposes Process Groups
- Missing Authorization in Apache NiFi Connector API Exposes Parameter Provider Secrets
Appears with
- Apache Software Foundationorganization · 3
- Apache Software Foundationvendor · 3
- Apachevendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.