CVE-2026-82561: 
NixOS vulnerability analysis and mitigation

CVE-2026-82561 is a Missing Authorization vulnerability in Apache NiFi's REST API, specifically affecting Process Group flow replacement and versioned flow update methods. It affects Apache NiFi versions 1.5.0 through 2.11.0 (component org.apache.nifi:nifi-web-api). The vulnerability was reported on 2026-08-06 by researcher n0mi1k and publicly disclosed on 2026-09-16 via the Apache security mailing list. It carries a CVSS v4.0 base score of 5.9 (Medium) (Apache Advisory, OSS-Sec).

The root cause is CWE-862 (Missing Authorization): REST API methods that perform synchronous Process Group flow replacement (PUT-style operations) only checked read/write privileges on the target Process Group itself, unlike the corresponding asynchronous update request methods which also authorize encapsulated components, referenced Controller Services, Parameter Contexts, and Parameter Providers. An authenticated attacker with write access to a Process Group can craft and submit a malicious flow definition via these REST API endpoints to modify or remove components in descendant Process Groups that are protected by more restrictive access policies, and to bind components to Controller Services or Parameter Contexts they are not authorized to access. The vulnerability is tracked internally as NIFI-16263 and is limited in scope to stopped components and deployments that use component-level authorization policies (OSS-Sec, Apache Advisory).

A successfully exploiting authenticated user can bypass component-level access controls to modify or delete stopped components in descendant Process Groups that would otherwise be protected by more restrictive policies, and can bind components to Controller Services and Parameter Contexts without proper authorization. This primarily affects integrity of the NiFi flow configuration, with limited confidentiality impact (e.g., exposure of configuration details of restricted components) and limited availability impact (restricted to stopped components). The vulnerability only affects deployments that have enabled component-level authorization policies; environments relying solely on Process Group-level write permissions as the security boundary are not additionally exposed (Apache Advisory, OSS-Sec).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authentication and write access to at least one Process Group, and attack requirements include the presence of component-level authorization policies in the target deployment, limiting the practical attack surface (Apache Advisory, OSS-Sec).

1. Reconnaissance: Identify an Apache NiFi instance running versions 1.5.0–2.11.0 that uses component-level authorization policies. Authenticate with a valid account that has write access to at least one Process Group.
2. Identify target components: Browse the NiFi UI or query the REST API to enumerate Process Groups and identify descendant groups with more restrictive access policies containing stopped components of interest.
3. Craft malicious flow definition: Construct a JSON flow definition that includes modifications or removals of components in the restricted descendant Process Groups, or that binds components to Controller Services or Parameter Contexts the attacker is not authorized to access.
4. Submit via REST API: Send the crafted flow definition to the synchronous Process Group replacement REST API endpoint (e.g., PUT /nifi-api/process-groups/{id} or the versioned flow update/rebase endpoint), bypassing the authorization checks that would normally be enforced by the asynchronous update methods.
5. Achieve objective: The server applies the flow definition without verifying authorization for the referenced descendant components, resulting in unauthorized modification or removal of stopped components and/or unauthorized binding to Controller Services and Parameter Contexts (OSS-Sec, Apache Advisory).

• Logs: NiFi application logs (nifi-app.log) showing unexpected PUT or flow update REST API calls to Process Group replacement endpoints by users who do not normally interact with those groups; audit log entries reflecting modifications to components in Process Groups the user should not have access to.
• NiFi UI / Configuration: Unexpected changes to stopped components in descendant Process Groups, including deletions or modifications; components bound to Controller Services or Parameter Contexts inconsistent with the user's authorization level.
• Network: REST API calls to /nifi-api/process-groups/{id} with large or unusual flow definition payloads originating from unexpected source IPs or user accounts.

The recommended mitigation is to upgrade to Apache NiFi 2.12.0, which applies consistent reference resolution and component authorization across all Process Group replacement and versioned flow update methods (Apache Advisory). For deployments that cannot immediately upgrade, administrators should review and restrict write access to Process Groups, limiting it to only fully trusted users. Note that this vulnerability only affects deployments using component-level authorization policies; environments that do not use such policies are not exposed to the additional risk described (OSS-Sec).

The vulnerability was disclosed by Apache NiFi maintainer David Handermann via the oss-security mailing list on 2026-09-16, crediting researcher n0mi1k as the finder. No significant broader media coverage or notable social media reactions have been identified beyond standard vulnerability database aggregation (OSS-Sec).