What is CVE-2026-44913?

CVE-2026-44913 is a high-severity vulnerability in Apache Nifi, classified under Improper Encoding or Escaping of Output. CVSS score: 7.2/10. Published 2026-06-22.

How severe is CVE-2026-44913?

High severity. CVSS v3 base score is 7.2 out of 10.

Vulnerability in Apache Nifi

CVE-2026-44913

Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowe…

EPSS: 0.004 (31.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apache Nifi
Apache Software Foundation Nifi — versions 1.2.0

Weakness classification (CWE)

CWE-116 — Improper Encoding or Escaping of Output

References

security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2026-44913?: CVE-2026-44913 is a high-severity vulnerability in Apache Nifi, classified under Improper Encoding or Escaping of Output. CVSS score: 7.2/10. Published 2026-06-22.
How severe is CVE-2026-44913?: High severity. CVSS v3 base score is 7.2 out of 10.