CVE-2026-81866: Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration

Apache NiFi 2.9.0 through 2.11.0 fail to enforce authorization checks on Assets and Secrets referenced by the Connector configuration update and verification REST API methods (CWE-862). An authenticated user who holds write privileges on a Connector can update or verify that Connector's configuration and thereby apply Secret values backed by a Parameter Provider they are not authorized to read; the same methods also accept Asset identifiers without verifying the Asset belongs to the Connector being configured. An attacker in this position gains access to restricted Secret values or Asset references that the deployment's authorization policy was meant to withhold. Only deployments that implement different levels of authorization across Connectors and Parameter Providers are affected, because sites using a uniform write-on-Connector policy are not exposed. No public proof of concept, CISA KEV listing, or reported in-the-wild exploitation is known, and the vendor rates the issue low severity (CVSS 4.0: 0.5) given the high-privilege prerequisite.

Do: Upgrade to Apache NiFi 2.12.0, which adds read-authorization checks for referenced Parameter Providers and validates Connector ownership of referenced Assets. Administrators who cannot upgrade should review which users have write access to Connectors and confirm they also hold read access to the Parameter Providers those Connectors reference, or tighten those policies. Audit recent Connector configuration updates and verifications for applied Secret or Asset references that should not have been authorized.