CVE-2026-44914

描述

Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. The Restricted annotation indicates additional privileges required, but framework authorization did not check restricted status when handling requests to replace Process Groups. The missing authorization permits a user with general write access to add components with Restricted status. Apache NiFi installations that do not implement specific authorization for Restricted components are not subject to this vulnerability because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation, which removes the implementation of Restricted status authorization from the framework.

如何修補 CVE-2026-44914

要修補 CVE-2026-44914,請將受影響套件升級到下列已修補版本。

• —升級至 2.10.0 或更新版本

CVE-2026-44914 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 1.12.0, < 2.10.0

CVSS 分數

參考連結(3)

• WEBwww.openwall.com/lists/oss-security/2026/06/20/6
• WEBlists.apache.org/thread/ydr34t03xd1n0t9oogpzogjrd5y93838
• WEBnvd.nist.gov/vuln/detail/CVE-2026-44914