Loading story…
Apache NiFi fixed CVE-2026-39816, a high-severity flaw that lets authenticated users execute arbitrary code without the EXECUTE_CODE permission when certain optional graph extensions are installed, particularly nifi-other-graph-services-nar. The issue affects NiFi versions 2.0.0-M1 through 2.8.0 and stems from the TinkerpopClientService, which can compile and run user-supplied Groovy code before submitting a graph query. Apache attributed the bug to a missing restricted annotation tied to the Execute Code required permission, creating a privilege-boundary bypass in deployments using TinkerPop graph query features.
The vulnerability was reported by John Walker of ZeroPath and tracked as NIFI-15800, with Apache addressing it in NiFi 2.9.0. ZeroPath said the flaw reflects a mismatch in NiFi’s privilege model, where graph query functionality was not treated as a code-execution path even though TinkerPop’s native query mode can trigger server-side code execution; the researchers also published a proof of concept showing shell access on a vulnerable server. Organizations running affected NiFi deployments are advised to upgrade to 2.9.0 or later or remove the impacted optional graph-related NAR extensions if an upgrade cannot be completed immediately.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
ZeroPath publicly disclosed CVE-2026-39816 as a high-severity Apache NiFi flaw affecting deployments with optional graph-related NAR extensions, especially nifi-other-graph-services-nar. The disclosure included technical details and a proof of concept showing arbitrary code execution and recommended upgrading to NiFi 2.9.0 or removing the affected extensions.
Apache addressed the vulnerability in Apache NiFi 2.9.0. The fix corrected the missing restricted annotation tied to the Execute Code required permission, remediating affected versions 2.0.0-M1 through 2.8.0 in vulnerable configurations.
ZeroPath Research reported the Apache NiFi vulnerability later assigned CVE-2026-39816 and tracked as NIFI-15800. The issue involved a permission-boundary bypass that could let authenticated users without EXECUTE_CODE run Groovy code when affected graph extensions were installed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
bugflation.com
Open sourcezeropath.com
Open sourcecyberpress.org
Open sourcegbhackers.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Apache NiFi** disclosed a high-severity authorization flaw, tracked as **CVE-2026-25903**, that allows a lower-privileged user to modify configuration properties of *Restricted* extension components after they have been added to a flow by a more privileged user. The issue affects NiFi versions **1.1.0 through 2.7.2** and stems from **missing authorization checks** during component property updates: the framework enforced the extra privileges required to *add* a Restricted component, but did not consistently re-check the component’s restricted status when *updating* it, enabling an authorization bypass (CWE-862). Potential impact includes tampering with dataflow logic and, depending on the component and environment, enabling unsafe actions such as triggering sensitive operations or altering processing behavior. Risk is conditional on deployments that implement distinct authorization levels for Restricted components; installations that do **not** differentiate authorization levels are described as not subject to this specific bypass because standard write permissions remain the effective security boundary. **Upgrading to NiFi 2.8.0** is the recommended mitigation, and the issue was reported via responsible disclosure (credited to **David Handermann** in reporting). CVE records also reference public advisories and include a **CVSS v4.0** vector indicating network reachability and high potential impact, while noting prerequisites such as the need for a privileged user to have already introduced the Restricted component into the flow.
Jun 29, 2026
Apache disclosed **CVE-2026-35194**, a critical remote code execution flaw in Apache Flink that allows authenticated users with query submission privileges to run arbitrary code on **TaskManager** nodes. The vulnerability is caused by improper escaping of user-controlled input during Flink’s SQL code-generation process, where malicious SQL can be translated into attacker-controlled Java code. Apache said the issue affects Flink `1.15.0` through `1.20.x` before `1.20.4`, and `2.0.0` through `2.x` before `2.0.2`, `2.1.2`, and `2.2.1`. The flaw impacts JSON functions introduced in `1.15.0` and `LIKE` expressions with `ESCAPE` clauses introduced in `1.17.0`, creating a serious risk for multi-tenant and shared environments where non-administrative users may be able to escalate access, manipulate data, compromise clusters, and move laterally. Apache credited Yaswant Katakam of Confluent InfoSec for reporting the bug, while public disclosure also highlighted the danger of SQL-to-Java code translation paths in Flink’s engine. Organizations were urged to upgrade immediately to the patched releases.
Jun 29, 2026
A **critical remote code execution** issue in the *n8n* open-source workflow automation platform, tracked as **CVE-2026-25049** (also published as **GHSA-6cqr-8cfr-67f8**), allows an **authenticated** user with permission to create or modify workflows to escape n8n’s expression sandbox and execute arbitrary system commands on the underlying host. The flaw stems from **insufficient input sanitization/weak sandboxing** in n8n’s expression evaluation (server-side JavaScript) and was identified during follow-up analysis after an earlier critical n8n vulnerability (**CVE-2025-68613**) was patched; researchers report the new issue effectively **bypasses prior mitigations**. Reporting indicates exploitation can lead to **full compromise** of the n8n instance, including access to the filesystem and the ability to **steal stored credentials and secrets** (e.g., API keys, OAuth tokens) and sensitive configuration, with potential for **pivoting** into connected internal services and cloud accounts in multi-tenant deployments. Public reporting also notes **public exploits** are available. n8n maintainers state the issue is patched, and affected organizations should upgrade to fixed releases (**1.123.17** and **2.5.2**), as versions **prior to 1.123.17 and 2.5.2** are impacted.
Jun 29, 2026