Not rated
CVE-2017-5636 In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization…
Description
In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache NiFi 1.1 | 1.1.0 → 1.1.1 | No fix stated |
| Apache NiFi 0.7 | 0.7.0 → 0.7.1 | No fix stated |
Other CVEs of Apache NiFi
The 47 CVEs of Apache NiFi →
CVE-2026-70469
Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests…
Not rated
CVE-2026-81866
Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not…
0.5
Low
CVE-2026-82561
Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a…
5.9
Medium
CVE-2026-86089
Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API…
2.3
Low