CVE-2026-39816 Apache CVE debrief

Who should care

NiFi administrators, platform owners, and security teams running Apache NiFi 2.0.0-M1 through 2.8.0, especially deployments that use fine-grained authorization and include the optional nifi-other-graph-services-nar package. Review access control around service configuration and any environments where non-admin users can create or edit controller services.

Technical summary

The issue is a missing Restricted annotation on the optional TinkerpopClientService. That annotation should have enforced Execute Code Required Permission. Without it, the service can be configured by users who are not supposed to have Execute Code permission. The service supports ByteCode Submission for the Script Submission Type, which allows Groovy script execution in the service before the query is submitted. The vulnerable range is Apache NiFi 2.0.0-M1 through 2.8.0, and the NVD criteria indicate the issue is resolved in 2.9.0.

Defensive priority

High; prioritize immediately for any affected NiFi deployment that uses the optional graph-services component and fine-grained authorization.

Recommended defensive actions

• Upgrade Apache NiFi to 2.9.0 as recommended by the vendor.
• Confirm whether nifi-other-graph-services-nar is installed; if it is not installed, the system is not subject to this vulnerability.
• Review controller service permissions and verify that users without Execute Code permission cannot configure code-capable services.
• Audit NiFi authorization policies for any non-admin paths that can edit or enable services in affected environments.
• Track and validate the presence of the Apache vendor advisory and NVD entry in your vulnerability management workflow.

Evidence notes

This debrief is based on the supplied CVE description, the NVD modification record, and the Apache mailing-list vendor advisory reference. The source corpus states that TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission, that the affected NiFi versions are 2.0.0-M1 through 2.8.0, that the optional nifi-other-graph-services-nar package must be installed for exposure, and that upgrading to 2.9.0 is the recommended mitigation. Timing context uses the CVE published and modified timestamps provided in the source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.