CVE-2026-44913

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44913
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-44913.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-44913
Aliases
Downstream
Published
2026-06-22T07:36:40.885Z
Modified
2026-07-11T03:55:19.282039982Z
Severity
  • 5.2 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/S:P/AU:Y/R:U/V:C/RE:L/U:Clear CVSS Calculator
Summary
Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL
Details

Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not cover additional strategies. Apache NiFi installations that do not use the CaptureChangeMySQL Processor are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which incorporates more robust identifier escaping.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.2.0"
                },
                {
                    "last_affected": "2.9.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "1.2.0"
                },
                {
                    "fixed": "2.9.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cna_assigner": "apache",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44913.json",
    "cwe_ids": [
        "CWE-116"
    ]
}
References

Affected packages

Git / github.com/apache/nifi

Affected ranges

Type
GIT
Repo
https://github.com/apache/nifi
Events
Introduced
3a605af8e0ac024fb0ba67262d49dab2727b2576
Fixed
2baff691128fa782983fb79bb1087adff027a4c1
Database specific 
{
    "extracted_events": [
        {
            "introduced": "1.2.0"
        },
        {
            "fixed": "2.10.0"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*"
}

Affected versions

nifi-1.*
nifi-1.2.0-RC2
rel/nifi-1.*
rel/nifi-1.2.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-44913.json"