Apache NiFi Vulnerabilities Expose Systems to Authorization Bypass Attacks

Apache NiFi users are advised to upgrade their installations due to a high-severity authorization flaw identified as CVE-2026-25903.

The vulnerability, disclosed on Mon, Feb 16, 2026, permits a less-privileged authenticated user to alter configuration properties on certain "restricted" extension components initially added by a more privileged user. This issue potentially undermines security controls in environments utilizing tiered permissions.

According to the Apache NiFi advisory , versions 1.1.0 through 2.7.2 lack an authorization check when updating configuration properties on extension components that specify Required Permissions through the Restricted annotation.

The Restricted annotation in NiFi is designed to enforce additional privileges for sensitive components, typically because they can interact with the operating system, execute code, access external services, or perform other actions requiring tight control.

CVE ID Severity Affected Versions Description

CVE-2026-25903 High 1.1.0 to 2.7.2 Missing authorization of restricted permissions for extension component property updates, enabling an authorization bypass

The vulnerability emerges from a discrepancy between the authority required to add a restricted component and to update it subsequently. While a more privileged user is needed to add such a component, the framework fails to verify its restricted status during updates. Consequently, a user without the necessary elevated permissions could modify the component's properties, resulting in an authorization bypass condition.

Not all deployments are equally vulnerable. Installations not implementing varied authorization levels for Restricted components are unaffected, as the standard write permissions serve as the primary security measure. However, for environments enforcing strict separation of duties—where some users edit flows while restricting component control to administrators—this flaw represents a significant breach of privilege boundaries.

To mitigate this issue, upgrading to Apache NiFi 2.8.0, which addresses the flaw, is recommended. Additionally, it is advisable to review current access policies for flow modification, audit component property changes, and ensure restricted components cannot be modified by roles with limited permissions.

Based on reporting by GBHackers.