CVE-2026-87976: 
NixOS vulnerability analysis and mitigation

CVE-2026-87976 is a path traversal vulnerability (CWE-22) in Apache NiFi Registry, titled "Improper Limitation of Pathname in Persisted Extension Bundles." It affects Apache NiFi Registry versions 0.4.0 through 2.11.0, where the default file persistence provider uses NAR manifest coordinates (group, artifact, version) as filesystem path components without rejecting parent-directory references, and performs path-containment checks against an unnormalized resolved path. The vulnerability was disclosed on September 16, 2026, by reporter "lichoin" and tracked internally as NIFI-16329. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.2 (High) (Apache Advisory, OSS-Sec).

The root cause is improper path validation (CWE-22) in the default file persistence provider of Apache NiFi Registry. When a NAR (NiFi Archive) is uploaded, the provider extracts group, artifact, and version coordinates from the manifest and uses them directly as filesystem path components without sanitizing or rejecting parent-directory sequences (e.g., ../). Additionally, the path-containment check compares an unnormalized resolved path, allowing a crafted manifest to bypass the intended storage boundary. An authenticated user with write and delete permissions on at least one bucket can exploit this by uploading a NAR with malicious coordinates, causing file system operations — including writes and deletes — to occur outside the designated file persistence directory (OSS-Sec, Apache Advisory).

Successful exploitation allows an authenticated attacker to write arbitrary files to or delete files from locations outside the NiFi Registry storage root on the underlying filesystem. This can lead to integrity and availability impacts — including overwriting critical system or application files, deleting configuration data, or potentially achieving code execution by placing malicious files in executable paths. Confidentiality is not directly impacted by this vulnerability, but the ability to write files arbitrarily could facilitate further system compromise or lateral movement (Apache Advisory, OSS-Sec).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Apache Advisory). Exploitation requires authentication and specific bucket write/delete permissions, limiting the attack surface to authorized users. The EPSS score is approximately 0.385%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify an Apache NiFi Registry instance running versions 0.4.0 through 2.11.0 and obtain credentials for an account with write and delete permissions on at least one bucket.
2. Craft malicious NAR manifest: Create a NAR archive with a crafted manifest where the group, artifact, or version coordinate contains path traversal sequences (e.g., ../../etc/cron.d or ../../opt/nifi/conf) to target a directory outside the storage root.
3. Upload the NAR: Submit the crafted NAR to the NiFi Registry API endpoint for extension bundle upload (e.g., POST /nifi-registry-api/buckets/{bucketId}/bundles/extension-bundles) using the authenticated session.
4. Trigger file system operation: The server processes the manifest coordinates without normalization, resolving the path outside the intended storage directory and writing the NAR content (or performing a delete) at the traversed location.
5. Achieve objective: Depending on the target path, the attacker may overwrite configuration files, plant a web shell or cron job for code execution, or delete critical files to cause denial of service (OSS-Sec, Apache Advisory).

• Network: Unusual HTTP POST requests to NiFi Registry bundle upload endpoints (e.g., /nifi-registry-api/buckets/*/bundles/extension-bundles) containing encoded path traversal sequences (../, %2e%2e%2f, %2e%2e/) in request bodies or manifest metadata.
• File System: Unexpected files appearing outside the NiFi Registry storage root directory (e.g., in /etc/, /tmp/, /opt/, or application config directories); missing or modified files in critical system paths that correlate with NiFi Registry process activity.
• Logs: NiFi Registry application logs showing bundle upload activity with unusual coordinate values containing dots or slashes; file access audit logs (e.g., auditd) recording the NiFi Registry process writing to paths outside its designated storage directory.
• Process: The NiFi Registry Java process spawning unexpected child processes or exhibiting unusual file I/O patterns to system directories.

The recommended remediation is to upgrade Apache NiFi Registry to version 2.12.0, which rejects parent-directory coordinates in NAR manifests and enforces normalized path validation to ensure all file operations remain within the storage root (Apache Advisory, OSS-Sec). Until patching is possible, restrict bucket write and delete permissions to only highly trusted users and monitor file system access patterns around the NiFi Registry storage directory for anomalous activity. Organizations should also consider placing the NiFi Registry storage directory on a dedicated filesystem or using OS-level controls (e.g., chroot, AppArmor, SELinux) to limit the process's file system access scope.

The vulnerability was reported by researcher "lichoin" and disclosed via the Apache security mailing list and oss-security on September 16, 2026 (OSS-Sec). Security news outlet SecurityOnline.info covered the advisory alongside other Apache NiFi security updates. The Infosec.exchange Mastodon account @DailyCyberSecurity also noted the disclosure. No significant broader community controversy or vendor dispute has been observed.