CVE-2026-87976 Apache Software Foundation CVE debrief

Who should care

System administrators and security teams responsible for NiFi Registry deployments should assess exposure and apply the recommended mitigation to prevent path manipulation attacks.

Why it matters

Defenders should prioritize verifying and upgrading to Apache NiFi Registry 2.12.0 to prevent path manipulation attacks. System administrators and security teams responsible for NiFi Registry deployments should assess exposure and apply the recommended mitigation.

• Path manipulation can lead to file system operations outside of the file persistence directory
• Authenticated users authorized to write and delete bundles in a bucket can upload a NAR with a crafted manifest
• Verification of affected versions and remediation efforts are necessary
• Compensating controls and monitoring may be required until mitigation is applied

Technical summary

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected parent-directory names, and the path-containment check compared an unnormalized resolved path. An authenticated user authorized to write and delete bundles in a bucket can upload a NAR with a crafted manifest resulting in file system operations outside of the file persistence directory. Upgrading to Apache NiFi Registry 2.12.0 is the recommended mitigation, which rejects parent-directory coordinates and requires a normalized

Defensive priority

Defenders should prioritize verifying and upgrading to Apache NiFi Registry 2.12.0 to prevent path manipulation attacks. System administrators and security teams responsible for NiFi Registry deployments should assess exposure and apply the recommended mitigation.

Recommended defensive actions

• Verify and upgrade to Apache NiFi Registry 2.12.0
• Assess exposure and apply recommended mitigation
• Monitor for suspicious activity and implement compensating controls
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail provide information on the path manipulation vulnerability in Apache NiFi Registry. The vendor advisory and mailing list references offer additional context on the issue and recommended mitigation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.