High severity · published May 8, 2026
CVE-2026-39816
Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Apache NiFi · Apache Software Foundation
2.0.0-M1 through 2.8.0 · source: vendor
NI
Nifi · Apache
2.0.0 before 2.9.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-39816
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-39816
Mailing List
https://lists.apache.org/thread/gh9g7xwvv4l20gzff6q3367snf35ctcb
Mailing List
http://www.openwall.com/lists/oss-security/2026/04/13/8
zeropath.com
https://zeropath.com/blog/nifi-cve-2026-39816-privesc-rce
More from Apache NiFi
9.8
CVE-2026-68979
Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates
9.1
CVE-2026-68980
Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion
7.5
CVE-2026-70469
Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests
7.5
CVE-2026-68981
Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
7.2
CVE-2026-44914
Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents