CVE-2026-39816 - Vulnerability Analysis

Overview

Apache NiFi 2.0.0-M1 through 2.8.0 contains a broken access control vulnerability caused by missing Restricted annotation with Execute Code Required Permission in TinkerpopClientService, letting unauthorized users configure Groovy script execution, exploit requires fine-grained authorization and installed TinkerpopClientService.

Severity & Score

Impact

Unauthorized users can configure Groovy script execution, potentially leading to unauthorized code execution or privilege escalation.

Mitigation

Upgrade to Apache NiFi 2.9.0 or later.

References

• https://zeropath.com/blog/nifi-cve-2026-39816-privesc-rce
• https://lists.apache.org/thread/gh9g7xwvv4l20gzff6q3367snf35ctcb
• http://www.openwall.com/lists/oss-security/2026/04/13/8

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner