High severity · published Jun 22, 2026
CVE-2026-44913
Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL
7.2
CVSS
0.6%
EPSS
No
On KEV
Description
Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not cover additional strategies. Apache NiFi installations that do not use the CaptureChangeMySQL Processor are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which incorporates more robust identifier escaping.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Apache NiFi · Apache Software Foundation
1.2.0 through 2.9.0 · source: vendor
NI
Nifi · Apache
1.2.0 before 2.10.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44913
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44913
Vendor Advisory
https://lists.apache.org/thread/c8vkt5rz4dqql6sjxgrr3zdkbt1sfmsl
Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/06/20/5
More from Apache NiFi
9.8
CVE-2026-68979
Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates
9.1
CVE-2026-68980
Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion
8.8
CVE-2026-39816
Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService
7.5
CVE-2026-70469
Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests
7.5
CVE-2026-68981
Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests