CVE-2026-86089 is a missing authorization flaw in Apache NiFi 2.11.0. Connector migration methods checked only the target Connector, so users could list or migrate Process Groups they were not allowed to touch. Apache recommends upgrading to NiFi 2.12.0. The record scores it High, but Apache rates it Low.
What's affected
- Product: Apache NiFi (
nifi-web-api), connector migration REST methods. - Affected: 2.11.0 only.
- Fixed: 2.12.0, which filters migration sources to Process Groups the user may read and requires write access to the source group.
- Limiting factors from Apache: the source group must be stopped with empty queues, sensitive property values are excluded, and installs without component level authorization policies for Process Groups are not affected.
Severity in the record: High, CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N). The record scores it 7.1 (High). The Apache announcement on oss-security labels the severity Low. Both are worth reading, and the Apache note explains the narrow conditions.
Weakness class: CWE-862 (Missing Authorization).
How to check if you're exposed
- Check your NiFi version in the About dialog, or run
nifi.sh statusand read the startup log for the version. If it is not 2.11.0, this issue does not apply. - Ask whether you use component level authorization policies on Process Groups. If you do not, the Apache note says you are not subject to this issue.
- Review which users have read or write access to Connectors but not to certain Process Groups.
- Check flow history for Process Groups that were renamed or disabled by a migration.
What to do now
- Upgrade Apache NiFi 2.11.0 to 2.12.0 or later.
- Review Process Group policies and the users who can write to Connectors.
- Look for Process Groups that were disabled and renamed unexpectedly, which is the visible trace of a migration.
- Check that flow definitions copied into Connectors do not contain assets that should stay in their original group.
- Keep Connector write access limited to a small group.
Why it matters
NiFi decided access by looking only at the target Connector. The question of whether the user could see or change the source Process Group was never asked. That is CWE-862, missing authorization. A read user could list identifiers, names and registry details of groups outside their policies, and a writer could copy a group's flow definition, assets and component state into a Connector, leaving the source disabled and renamed.
The conditions make it narrow, which explains Apache's Low label against the record's High. Two views of severity can both be fair: one counts worst case technical impact, the other weighs how few installs meet the conditions. The record does not claim exploitation in the wild.
Try it yourself
This demo shows how you can rank an advisory by who it affects in your estate, not only by its score.
Click through it at your own pace, or open it full screen.
Quick check
Why does Apache call it Low when the record says High?
Apache points to limits: stopped source groups with empty queues, no sensitive values, and only installs that use component level Process Group policies. The record's score reflects the technical impact without those limits.
Sources
Last reviewed: 18 October 2026.
