Vulnerability-Lookup

CNVD-2026-21831

Vulnerability from cnvd - Published: 2026-05-20

Title

Apache NiFi TinkerpopClientService权限绕过漏洞

Description

Apache NiFi是一个用于数据流自动化和数据分发的集成平台，支持从多种数据源高效收集、处理和管理数据。 Apache NiFi存在权限绕过漏洞。该漏洞产生的原因是可选扩展组件TinkerpopClientService缺少Restricted注解及Execute Code Required Permission，攻击者可利用该漏洞无需Execute Code Permission即可配置该服务，从而执行Groovy脚本。

Severity

高

Patch Name

Apache NiFi TinkerpopClientService权限绕过漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://lists.apache.org/thread/gh9g7xwvv4l20gzff6q3367snf35ctcb

Reference

https://nvd.nist.gov/vuln/detail/CVE-2026-39816

Impacted products

Name
Apache NiFi >=2.0.0，<2.9.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2026-39816",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-39816"
    }
  },
  "description": "Apache NiFi\u662f\u4e00\u4e2a\u7528\u4e8e\u6570\u636e\u6d41\u81ea\u52a8\u5316\u548c\u6570\u636e\u5206\u53d1\u7684\u96c6\u6210\u5e73\u53f0\uff0c\u652f\u6301\u4ece\u591a\u79cd\u6570\u636e\u6e90\u9ad8\u6548\u6536\u96c6\u3001\u5904\u7406\u548c\u7ba1\u7406\u6570\u636e\u3002\n\nApache NiFi\u5b58\u5728\u6743\u9650\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u4ea7\u751f\u7684\u539f\u56e0\u662f\u53ef\u9009\u6269\u5c55\u7ec4\u4ef6TinkerpopClientService\u7f3a\u5c11Restricted\u6ce8\u89e3\u53caExecute Code Required Permission\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u65e0\u9700Execute Code Permission\u5373\u53ef\u914d\u7f6e\u8be5\u670d\u52a1\uff0c\u4ece\u800c\u6267\u884cGroovy\u811a\u672c\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://lists.apache.org/thread/gh9g7xwvv4l20gzff6q3367snf35ctcb",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-21831",
  "openTime": "2026-05-20",
  "patchDescription": "Apache NiFi\u662f\u4e00\u4e2a\u7528\u4e8e\u6570\u636e\u6d41\u81ea\u52a8\u5316\u548c\u6570\u636e\u5206\u53d1\u7684\u96c6\u6210\u5e73\u53f0\uff0c\u652f\u6301\u4ece\u591a\u79cd\u6570\u636e\u6e90\u9ad8\u6548\u6536\u96c6\u3001\u5904\u7406\u548c\u7ba1\u7406\u6570\u636e\u3002\r\n\r\nApache NiFi\u5b58\u5728\u6743\u9650\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u4ea7\u751f\u7684\u539f\u56e0\u662f\u53ef\u9009\u6269\u5c55\u7ec4\u4ef6TinkerpopClientService\u7f3a\u5c11Restricted\u6ce8\u89e3\u53caExecute Code Required Permission\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u65e0\u9700Execute Code Permission\u5373\u53ef\u914d\u7f6e\u8be5\u670d\u52a1\uff0c\u4ece\u800c\u6267\u884cGroovy\u811a\u672c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache NiFi TinkerpopClientService\u6743\u9650\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Apache NiFi \u003e=2.0.0\uff0c\u003c2.9.0"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2026-39816",
  "serverity": "\u9ad8",
  "submitTime": "2026-05-09",
  "title": "Apache NiFi TinkerpopClientService\u6743\u9650\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2026-39816 (GCVE-0-2026-39816)

Vulnerability from cvelistv5 – Published: 2026-05-08 13:38 – Updated: 2026-05-09 01:12

Title

Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService

Summary

The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.

Severity

7.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:I/V:C/RE:L/U:Green

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-08 14:36 UTC

CWE

CWE-862 - Missing Authorization

Assigner

apache mitre root

References

3 references

URL	Tags
https://lists.apache.org/thread/gh9g7xwvv4l20gzff…	vendor-advisory
http://www.openwall.com/lists/oss-security/2026/04/13/8
https://zeropath.com/blog/nifi-cve-2026-39816-pri…

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache NiFi	Affected: 2.0.0-M1 , ≤ 2.8.0 (semver)

Credits

John Walker from ZeroPath

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-05-09T01:12:19.254Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/04/13/8"
          },
          {
            "url": "https://zeropath.com/blog/nifi-cve-2026-39816-privesc-rce"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-39816",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-08T14:36:48.324372Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-08T14:37:01.661Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.nifi:nifi-other-graph-services-nar",
          "product": "Apache NiFi",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.8.0",
              "status": "affected",
              "version": "2.0.0-M1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Walker from ZeroPath"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation."
            }
          ],
          "value": "The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "IRRECOVERABLE",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "providerUrgency": "GREEN",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "CONCENTRATED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:I/V:C/RE:L/U:Green",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "LOW"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-08T13:38:12.925Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/gh9g7xwvv4l20gzff6q3367snf35ctcb"
        }
      ],
      "source": {
        "defect": [
          "NIFI-15800"
        ],
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-04-03T12:00:00.000Z",
          "value": "reported"
        },
        {
          "lang": "en",
          "time": "2026-04-06T12:00:00.000Z",
          "value": "patched"
        }
      ],
      "title": "Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-39816",
    "datePublished": "2026-05-08T13:38:12.925Z",
    "dateReserved": "2026-04-07T16:21:21.196Z",
    "dateUpdated": "2026-05-09T01:12:19.254Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2026-21831

CVE-2026-39816 (GCVE-0-2026-39816)

Tags

Sightings

Nomenclature

Related by attack behaviour