Apache Nifi
50 CVEs affecting Apache Nifi. Latest disclosed: 2026-06-22. Critical: 3, High: 23.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1309 | Critical | 9.8 | 2018-05-23 | Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disa… |
CVE-2017-15697 | Critical | 9.8 | 2018-01-23 | A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to prope… |
CVE-2017-5636 | Critical | 9.8 | 2017-10-19 | In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack w… |
CVE-2026-39816 | High | 8.8 | 2026-05-08 | The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1… |
CVE-2025-66524 | High | 8.8 | 2025-12-19 | Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for s… |
CVE-2023-36542 | High | 8.8 | 2023-07-29 | Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authentica… |
CVE-2023-34468 | High | 8.8 | 2023-06-12 | The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configu… |
CVE-2022-33140 | High | 8.8 | 2022-06-15 | The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution… |
CVE-2019-12421 | High | 8.8 | 2019-11-19 | When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token… |
CVE-2021-20190 | High | 8.1 | 2021-01-19 | A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from th… |
CVE-2023-49145 | High | 7.9 | 2023-11-27 | Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-bas… |
CVE-2023-22832 | High | 7.5 | 2023-02-10 | The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the… |
CVE-2022-29265 | High | 7.5 | 2022-04-30 | Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer ser… |
CVE-2020-9491 | High | 7.5 | 2020-10-01 | In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like Liste… |
CVE-2020-9487 | High | 7.5 | 2020-10-01 | In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a do… |
CVE-2020-9486 | High | 7.5 | 2020-10-01 | In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, t… |
CVE-2020-1942 | High | 7.5 | 2020-02-11 | In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a no… |
CVE-2018-17195 | High | 7.5 | 2018-12-19 | The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resultin… |
CVE-2018-17194 | High | 7.5 | 2018-12-19 | When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, t… |
CVE-2018-1310 | High | 7.5 | 2018-05-23 | Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS content could cause denial of service. See ActiveMQ CVE-2015-5254… |