CVE-2026-39816

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
May 8, 2026
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-398175.9The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenaCVE-2026-398195.3The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with acCVE-2026-39824.3A vulnerability was determined in itsourcecode University Management System 1.0. Affected by this vulnerability is an unknown functionality CVE-2026-398207.5Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocatiCVE-2026-398219.6The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xCVE-2026-398227.8On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of CVE-2026-398236.1CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL conteCVE-2026-398243.3NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeStriCVE-2026-398255.3ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director fuCVE-2026-398266.1If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespacCVE-2026-398276.5An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually craCVE-2026-398286.3When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded,