CVE-2026-86089: Apache NiFi: Missing Process Group Authorization for Connector Migration
Apache NiFi 2.11.0 Connector Migration REST APIs authorize only against the target Connector, skipping Process Group access checks (CVE-2026-86089, Low).
Apache NiFi 2.11.0 supports migrating version-controlled Process Group contents into a Connector via REST API methods that list eligible migration sources and submit migration requests. Both methods were authorized only against the target Connector, without evaluating user access to the involved Process Groups. The flaw, tracked as CVE-2026-86089, is rated Low severity and affects the nifi-web-api component.
- Affects only Apache NiFi 2.11.0 (nifi-web-api)
- Authorization checks omitted for Process Groups used in Connector migration
- Rated Low severity in the official Apache disclosure
- Disclosed via the oss-security mailing list by David Handermann
- CVEs
- CVE-2026-86089
- Vendors
- Apache Software Foundation
- Products
- Apache NiFi
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-86089 | Missing Authorization in Apache NiFi Connector Migration Exposes Process Groups | 2.3 | — |
From the original article
Posted by David Handermann on Sep 16 Severity: Low Affected versions: - Apache NiFi (org. apache. nifi:nifi-web-api) 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.