CVE-2026-81866: Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration
Apache NiFi 2.9.0-2.11.0 Connector configuration update and verification APIs skip authorization for referenced Assets and Secrets (CVE-2026-81866, Low).
Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checks on Assets and Secrets referenced in the proposed configuration. Updating or verifying a Connector configuration can apply Asset and Secret references without the caller holding the required privileges. The issue, CVE-2026-81866, is rated Low severity and affects the nifi-web-api component.
- Affects Apache NiFi 2.9.0 through 2.11.0 (nifi-web-api)
- Authorization not enforced for Assets and Secrets in Connector configuration
- Update and verification REST methods both affected
- Rated Low severity in the official Apache disclosure
- CVEs
- CVE-2026-81866
- Vendors
- Apache Software Foundation
- Products
- Apache NiFi
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-81866 | Missing Authorization in Apache NiFi Connector API Exposes Parameter Provider Secrets | 0.5 | — |
From the original article
Posted by David Handermann on Sep 16 Severity: Low Affected versions: - Apache NiFi (org. apache. nifi:nifi-web-api) 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.