CVE-2026-39816

The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.

• CWE-862

• https://lists.apache.org/thread/gh9g7xwvv4l20gzff6q3367snf35ctcbMailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2026/04/13/8Mailing List, Third Party Advisory
• https://zeropath.com/blog/nifi-cve-2026-39816-privesc-rce

Published

May 8, 2026

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39810A use of hard-coded cryptographic key vulnerability in Forti…5.5
• CVE-2026-39811A integer overflow or wraparound vulnerability in Fortinet F…4.9
• CVE-2026-39812A improper neutralization of input during web page generatio…4.8
• CVE-2026-39813A path traversal: '../filedir' vulnerability in Fortinet For…9.8
• CVE-2026-39814A relative path traversal vulnerability in Fortinet FortiWeb…6.7
• CVE-2026-39815A improper neutralization of special elements used in an sql…8.8
• CVE-2026-39817The "go tool pack" subcommand (usually used only by the comp…5.9
• CVE-2026-39819The "go bug" command writes to two files with predictable na…5.3
• CVE-2026-3982A vulnerability was determined in itsourcecode University Ma…4.3
• CVE-2026-39820Well-crafted inputs reaching ParseAddress, ParseAddressList,…7.5
• CVE-2026-39821The ToASCII and ToUnicode functions incorrectly accept Punyc…9.6
• CVE-2026-39822On Unix systems, opening a file in an os.Root improperly fol…7.8