CVE-2026-39816 json
Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService
published 2026-05-08 6 mo ago modified 2026-10-26 13 d ago also BIT-nifi-2026-39816 , EUVD-2026-28593 , GHSA-2j9m-25xv-mp6r
- cvss
- 8.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.
Patch / fix
- maven org.apache.nifi:nifi-other-graph-services-nar 2.9.0
- bitnami nifi 2.9.0
- apache nifi 2.9.0
- github.com/apache/nifi@72fab7d commit
- github.com/apache/nifi#11108 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 6 mo ago
Exploit prediction
0.76% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.5 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/R:I/V:C/RE:L/U:Green |
| GitHub | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 7.5 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:I/V:C/RE:L/U:Green |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.nifi:nifi-other-graph-services-nar | >=2.0.0-M1, <2.9.0 |
2.9.0 |
| bitnami | nifi | >=2.0.0, <2.9.0 |
2.9.0 |
Affected products
- Apache Software Foundation Apache NiFi
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/apache/nifi/pull/11108
web
-
github.com
/apache/nifi/commit/72fab7dde74edfd1063b57e87b0334340c1fbe93
web
-
lists.apache.org
/thread/gh9g7xwvv4l20gzff6q3367snf35ctcb
vendor-advisory, web, mailing-list, advisory
-
openwall.com
/lists/oss-security/2026/04/13/8
web, mailing-list, third-party-advisory, advisory
-
zeropath.com
/blog/nifi-cve-2026-39816-privesc-rce
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-39816
advisory, web
-
github.com
/apache/nifi
package
Sources
- CVE List CVE-2026-39816
- GitHub Advisory GHSA-2j9m-25xv-mp6r
- NVD CVE-2026-39816
- OSV BIT-nifi-2026-39816
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.