CVE-2025-27017: 
Java vulnerability analysis and mitigation

Apache NiFi versions 1.13.0 through 2.2.0 contain a security vulnerability (CVE-2025-27017) where MongoDB authentication credentials are exposed in NiFi provenance events. The vulnerability was discovered by Robert Creese and publicly disclosed on March 11, 2025. This issue affects the data flow automation tool that is widely used for cybersecurity, observability, event streams, and generative AI applications (Security Online, OSS Security).

The vulnerability is classified as CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory). It has received a CVSS 4.0 Base Score of 6.9 (Medium) with the vector string CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/S:P/AU:Y/R:U/V:C/RE:L/U:Green. The issue specifically involves the inclusion of MongoDB usernames and passwords in NiFi provenance events, which are generated during processing by MongoDB components (NVD Database).

The vulnerability allows authorized users with read access to provenance events to view MongoDB authentication credentials. This exposure could potentially lead to unauthorized access to sensitive data stored in the MongoDB database if the credentials are compromised (Security Online).

The vulnerability requires an attacker to have authorized access to the NiFi system with read permissions for provenance events. While this limits the potential attack surface, it represents a significant risk for organizations where multiple users have access to the NiFi system (NVD Database).

The recommended mitigation is to upgrade to Apache NiFi version 2.3.0, which removes the credentials from provenance event records. This version has been specifically patched to address the vulnerability and prevent credential exposure (OSS Security).