CVE-2026-39816

Modified Modified - Updated After Analysis

Privilege Escalation in Apache NiFi TinkerpopClientService

Publication date: 2026-05-08

Last updated on: 2026-05-09

Assigner: Apache Software Foundation

Description

The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-08

Last Modified

2026-05-09

Generated

2026-07-09

AI Q&A

2026-05-08

EPSS Evaluated

2026-07-08

NVD

CVE-2026-39816

EUVD

EUVD-2026-28593

Affected Vendors & Products

Vendor	Product	Version / Range
apache	nifi	From 2.0.0 (inc) to 2.9.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-39816 is a high-severity vulnerability in Apache NiFi versions 2.0.0-M1 through 2.8.0 affecting the optional TinkerpopClientService component.

The vulnerability arises because the TinkerpopClientService is missing the required Restricted annotation that enforces the Execute Code permission.

This missing annotation allows users who do not have the Execute Code permission to configure the service and submit Groovy scripts for execution via ByteCode or Script Submission.

This means unauthorized users can potentially execute arbitrary code within the affected Apache NiFi installations that have fine-grained authorization enabled and the nifi-other-graph-services-nar extension installed.

Upgrading to Apache NiFi version 2.9.0 or later mitigates this vulnerability.

Impact Analysis

This vulnerability can allow unauthorized users to execute arbitrary Groovy scripts within Apache NiFi installations that have fine-grained authorization enabled and the optional TinkerpopClientService installed.

Such unauthorized code execution can lead to compromise of the system, unauthorized access to data, disruption of services, or other malicious activities.

The impact is significant because it bypasses intended permission restrictions, potentially allowing attackers to escalate privileges or manipulate workflows.

Detection Guidance

Detection of this vulnerability involves verifying if your Apache NiFi installation includes the optional TinkerpopClientService component, specifically the nifi-other-graph-services-nar extension, and if fine-grained authorization is enabled.

You can check the installed NiFi version and the presence of the nifi-other-graph-services-nar extension by inspecting the NiFi installation directory or using NiFi's API or CLI tools.

Since the vulnerability relates to missing permission annotations allowing unauthorized configuration of the TinkerpopClientService, you can audit user permissions and configurations related to this service.

Specific commands are not provided in the available resources.

Mitigation Strategies

The recommended immediate mitigation is to upgrade Apache NiFi to version 2.9.0 or later, where this vulnerability is resolved.

If upgrading is not immediately possible, ensure that the nifi-other-graph-services-nar extension is not installed or disable the TinkerpopClientService component to prevent exploitation.

Additionally, review and tighten fine-grained authorization settings to restrict access to users with Execute Code permissions.

Compliance Impact

The provided information does not specify how CVE-2026-39816 affects compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-39816. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70