CVE-2026-86089 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache NiFi installations, particularly those with component-level authorization policies for Process Groups, should assess exposure and prioritize upgrading to Apache NiFi 2.12.0.

Why it matters

CVE-2026-86089 allows unauthorized Process Group enumeration and migration in Apache NiFi 2.11.0. Defenders should prioritize upgrading to Apache NiFi 2.12.0 and review authorization policies.

• Enumeration of version-controlled Process Groups outside granted read policies
• Migration of Process Groups without write access
• Potential for unauthorized access to sensitive data
• Need for upgrading to Apache NiFi 2.12.0 for mitigation

Technical summary

The vulnerability in Apache NiFi 2.11.0 allows an authenticated user with read access to a Connector to enumerate version-controlled Process Groups outside their granted read policies and a user with write access to a Connector to migrate a Process Group without write access to that Process Group. The issue arises from insufficient authorization checks during migration source listing and submission. Upgrading to Apache NiFi 2.12.0 mitigates the issue by enforcing authorization checks. Defenders should prioritize upgrading and review authorization policies to prevent unauthorized access. The vulnerability does not allow access to sensitive property values and requires the source Process Group to be stopped with

Defensive priority

Defenders should prioritize upgrading to Apache NiFi 2.12.0 to mitigate the vulnerability. They should also review and implement component-level authorization policies for Process Groups to prevent unauthorized access.

Recommended defensive actions

• Upgrade to Apache NiFi 2.12.0
• Review and implement component-level authorization policies for Process Groups
• Monitor for unauthorized access to Process Groups
• Confirm whether affected Apache NiFi 2.11.0 deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability allows an authenticated user with read access to a Connector to enumerate version-controlled Process Groups outside their granted read policies and a user with write access to a Connector to migrate a Process Group without write access to that Process Group. The issue is mitigated in Apache NiFi 2.12.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.