Apache NiFi is missing the Restricted annotation with the Execute Code Required Permission
The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.apache.nifi:nifi-other-graph-services-nar | >= 2.0.0-M1, < 2.9.0 | 2.9.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-39816
- https://github.com/apache/nifi/pull/11108
- https://github.com/apache/nifi/commit/72fab7dde74edfd1063b57e87b0334340c1fbe93
- https://github.com/apache/nifi
- https://lists.apache.org/thread/gh9g7xwvv4l20gzff6q3367snf35ctcb
- https://zeropath.com/blog/nifi-cve-2026-39816-privesc-rce
- http://www.openwall.com/lists/oss-security/2026/04/13/8
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-862- Platform
- Java / Kotlin (Maven)
- Package
org.apache.nifi:nifi-other-graph-services-nar- Disclosed
- 08.05.2026
- Updated
- 11.10.2026 12:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-2j9m-25xv-mp6r - CC BY 4.0
Vulnerability history: org.apache.nifi:nifi-other-graph-services-nar
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.