CVE-2026-86089: Apache NiFi: Missing Process Group Authorization for Connector Migration

As cited

Copy frozen at 2026-09-17 01:51 UTC (site build).

vulnerabilities

CVE-2026-86089: Apache NiFi: Missing Process Group Authorization for Connector Migration

Apache NiFi 2.11.0 fails to validate authorization on Process Groups when migrating their contents into Connectors via REST application programming interface (API) methods. An attacker with access to a target Connector could exploit this to migrate Process Group contents without proper permissions. The vulnerability carries low severity.

Why it matters: Organizations running Apache NiFi 2.11.0 should assess whether users with Connector access can reach Process Groups they should not modify, and apply updates or restrict API access to limit exposure.

Source published

2026-09-16 15:19 UTC

First seen by Cybersecurity Tracker

2026-09-16 17:33 UTC