CVE-2026-86089: 
NixOS vulnerability analysis and mitigation

CVE-2026-86089 is a Missing Authorization vulnerability (CWE-862) in Apache NiFi 2.11.0, titled "Missing Process Group Authorization for Connector Migration." The flaw affects only version 2.11.0 of the org.apache.nifi:nifi-web-api component; all other versions are unaffected by default. It was reported on 2026-08-05 and publicly disclosed on 2026-09-16 via the Apache security mailing list. The vulnerability carries a CVSS v4.0 base score of 2.3 (Low severity) (Apache Advisory, OSS-Sec).

The root cause is CWE-862 (Missing Authorization): Apache NiFi 2.11.0 introduced REST API methods to list eligible migration sources and submit migration requests for moving version-controlled Process Group contents into a Connector. The framework evaluated authorization only against the target Connector, entirely omitting access checks on the source Process Groups involved. This allows an authenticated user with Connector read access to enumerate Process Group identifiers, names, and flow registry details beyond their granted policies, and a user with Connector write access to migrate Process Groups they have no write permission on — copying flow definitions, referenced assets, and component state while disabling and renaming the source Process Group. Exploitation is constrained by the requirement that the source Process Group must be stopped with empty queues, and sensitive property values are excluded from migration (OSS-Sec, Apache Advisory). The issue is tracked as NIFI-16272.

An authenticated attacker with read access to a Connector can enumerate identifiers, names, and flow registry details of version-controlled Process Groups outside their authorized scope, representing a confidentiality impact. An attacker with Connector write access can migrate unauthorized Process Groups, copying flow definitions, referenced assets, and component state into the Connector while leaving the source Process Group disabled and renamed — representing both an integrity and availability impact on the source Process Group. Sensitive property values are excluded from migration, and the source Process Group must be stopped with empty queues, which limits the overall exposure scope. Installations that do not implement component-level authorization policies for Process Groups are not affected, as Connector write permissions serve as the effective security boundary (OSS-Sec, Apache Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Apache Advisory). The vulnerability requires authenticated access with at minimum Connector read or write permissions, limiting the attack surface. No threat actor attribution has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The CVSS v4.0 score of 2.3 (Low) reflects the constrained exploitation conditions, including the requirement for attack prerequisites (source Process Group stopped with empty queues) (OSS-Sec).

1. Authentication: Obtain valid credentials for an Apache NiFi 2.11.0 instance with at minimum read access to a Connector component.
2. Enumerate migration sources: Send an authenticated REST API request to the endpoint that lists eligible migration sources for a target Connector. Due to the missing authorization check, the response will include identifiers, names, and flow registry details of all version-controlled Process Groups, regardless of the user's read permissions on those groups.
3. Select target Process Group: Identify a Process Group of interest from the enumerated list that the attacker does not have authorized access to.
4. Trigger migration (write access required): If the attacker also has write access to the Connector, submit a migration request via the REST API targeting the selected Process Group. The source Process Group must be stopped with empty queues for the request to succeed.
5. Access migrated content: Once migration completes, the flow definition, referenced assets, and component state of the source Process Group are copied into the Connector. The source Process Group is left disabled and renamed. The attacker can then inspect the migrated content (excluding sensitive property values) (OSS-Sec, Apache Advisory).

• Network: Unusual authenticated REST API calls to NiFi endpoints related to Connector migration (e.g., listing migration sources or submitting migration requests) from users who do not normally interact with those endpoints.
• Logs: NiFi application logs showing REST API access to migration-related endpoints by users with only Connector-level permissions; repeated enumeration of Process Group migration sources by a single user account.
• Application State: Unexpected Process Groups appearing in a disabled and renamed state without a corresponding authorized migration workflow; Connector components containing flow definitions from Process Groups the Connector owner should not have access to.
• Audit Trail: NiFi audit logs recording migration events initiated by users lacking write access to the source Process Group (OSS-Sec).

The recommended mitigation is to upgrade to Apache NiFi 2.12.0, which filters migration sources to only Process Groups the requesting user is authorized to read and enforces write authorization on the source Process Group when submitting a migration request (Apache Advisory, OSS-Sec). Organizations that do not implement component-level authorization policies for Process Groups are not subject to this vulnerability, as the framework enforces Connector write permissions as the security boundary and no additional workaround is needed in that configuration. For those unable to upgrade immediately, reviewing and tightening Connector access permissions to limit who holds read or write access can reduce exposure.

The vulnerability was credited to researchers ZsZsec and Alpesh Bhagwatkar, who reported it to Apache on 2026-08-05 (OSS-Sec). The Apache NiFi project disclosed the issue with a Low severity rating and provided a patch in NiFi 2.12.0 on the same day as public disclosure. No significant broader media coverage or notable community commentary beyond the standard security mailing list announcement has been observed.