CVE-2026-81866

Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets and Secrets referenced in proposed configuration. Updating or verifying a Connector configuration step can apply Asset and Secret references, but framework authorization was limited to write privileges on the Connector itself. As a result of the missing authorization, an authenticated user authorized to modify a Connector, but not authorized to read a referenced Parameter Provider, could apply Secret values backed by that Parameter Provider. The same methods also accepted Asset identifiers without verifying that the Asset belonged to the Connector being configured. Apache NiFi installations that do not implement different levels of authorization across Connectors and Parameter Providers are not subject to this vulnerability, because the framework enforces write permissions on the Connector as the security boundary. Upgrading to Apache NiFi 2.12.0 is the recommended mitigation, which authorizes read access to referenced Parameter Providers and verifies Connector ownership of referenced Assets during configuration update and verification.

• CWE-862

• https://lists.apache.org/thread/rv49gwf4yb00ykv0zzfd509boxflolsfMailing List, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2026/09/16/8Mailing List, Third Party Advisory

Published

Sep 16, 2026

Last Modified

Sep 21, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-81852Use of Insufficiently Random Values vulnerability in ash-pro…2.1
• CVE-2026-81853Authorization Bypass Through User-Controlled Key vulnerabili…2.3
• CVE-2026-81855A hardcoded cryptographic client authentication key vulnerab…9.1
• CVE-2026-81859CP4BA - IBM Enterprise Records could allow a local attacker …6.2
• CVE-2026-8186A vulnerability was detected in Open5GS up to 2.7.7. This af…7.5
• CVE-2026-81861CWE-522: Insufficiently Protected Credentials vulnerability …5.9
• CVE-2026-81868Steeltoe is an open source project that provides a collectio…6.5
• CVE-2026-81869OpenTelemetry-Go is the Go implementation of OpenTelemetry. …5.1
• CVE-2026-8187A flaw has been found in Open5GS up to 2.7.7. This impacts t…7.5
• CVE-2026-81870OpenTelemetry-Go is the Go implementation of OpenTelemetry. …2
• CVE-2026-81871OpenTelemetry-Go is the Go implementation of OpenTelemetry. …6.3
• CVE-2026-81872OpenTelemetry-Go is the Go implementation of OpenTelemetry. …6.3