CVE-2026-44913: Apache NiFi SQL Injection Vulnerability

CVE-2026-44913 Overview

CVE-2026-44913 is a SQL injection vulnerability in the CaptureChangeMySQL Processor shipped with Apache NiFi versions 1.2.0 through 2.9.0. The flaw stems from improper escaping of database table names, which allows an authenticated attacker to inject SQL commands through crafted identifier naming. Apache NiFi 1.8.0 introduced manual quoted boundaries that narrowed the attack surface, but the protection did not cover all injection strategies. Apache NiFi deployments that do not use the CaptureChangeMySQL Processor are not affected. The Apache NiFi project recommends upgrading to version 2.10.0, which implements more robust identifier escaping.

Critical Impact
An authenticated user with privileges to configure the CaptureChangeMySQL Processor can inject arbitrary SQL through crafted table names, impacting downstream MySQL systems integrated with NiFi data flows.

Affected Products

Apache NiFi 1.2.0 through 1.7.x (no manual quoted boundaries)
Apache NiFi 1.8.0 through 1.x (partial mitigation, still vulnerable)
Apache NiFi 2.0.0 through 2.9.0

Discovery Timeline

2026-06-22 - CVE-2026-44913 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-44913

Vulnerability Analysis

The CaptureChangeMySQL Processor in Apache NiFi reads binary log events from a MySQL server and translates them into change data capture (CDC) records for downstream processing. To construct SQL statements that reference source tables, the processor incorporates database and table identifiers into generated queries. The implementation fails to apply complete identifier escaping rules, classified under [CWE-116] Improper Encoding or Escaping of Output. An attacker who controls table naming in the monitored MySQL instance, or who can influence processor configuration, can supply identifiers that break out of the intended SQL context and append attacker-controlled SQL fragments. The partial fix introduced in Apache NiFi 1.8.0 added manual quoting around identifiers, but did not handle all escape sequences and edge cases that allow boundary escape.

Root Cause

The root cause is reliance on manual string concatenation and partial quoting when building SQL statements that include MySQL identifiers. Apache NiFi versions before 1.8.0 performed no identifier quoting. Versions 1.8.0 through 2.9.0 added quoting, but failed to escape embedded quote characters and other identifier metacharacters consistently. Apache NiFi 2.10.0 replaces the ad-hoc approach with a more robust identifier escaping routine that handles the full range of valid MySQL identifier syntax.

Attack Vector

Exploitation requires high privileges and user interaction, and proceeds over the network as defined by the CVSS 4.0 vector. An attacker must either control the schema of the monitored MySQL instance or influence the configuration of the CaptureChangeMySQL Processor. By introducing a table with a crafted name containing SQL metacharacters, the attacker causes the processor to emit SQL statements that execute injected commands against integrated systems. The vulnerability does not directly compromise the NiFi node itself, but propagates injection downstream into subsequent SQL components and tracked systems. No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is available for this vulnerability. See the Apache Mailing List Thread for the vendor advisory details.

Detection Methods for CVE-2026-44913

Indicators of Compromise

Unexpected MySQL table names containing quote characters, backticks, semicolons, or SQL keywords in monitored databases.
Anomalous SQL statements emitted by NiFi flow files that include unescaped identifier fragments.
Modifications to CaptureChangeMySQL Processor configuration by non-administrative users.
New table creation events in source MySQL servers that coincide with unexpected downstream query failures.

Detection Strategies

Inventory all Apache NiFi deployments and identify any flow that uses the CaptureChangeMySQL Processor.
Audit NiFi processor configuration history for unauthorized changes to MySQL connection or table inclusion parameters.
Inspect MySQL binary log entries for CREATE TABLE events containing identifier names with embedded backticks or quote characters.
Correlate NiFi provenance events with downstream SQL execution logs to identify unexpected statement structures.

Monitoring Recommendations

Enable Apache NiFi provenance reporting and forward events to a centralized log platform.
Monitor MySQL information_schema.tables for newly created tables with non-standard identifier characters.
Alert on changes to NiFi processor properties through the NiFi REST API audit logs.
Track failed or malformed SQL statements emitted by downstream PutDatabaseRecord or ExecuteSQL processors.

How to Mitigate CVE-2026-44913

Immediate Actions Required

Upgrade Apache NiFi to version 2.10.0 or later, which incorporates robust identifier escaping.
Audit existing flows for use of the CaptureChangeMySQL Processor and review their configuration.
Restrict NiFi administrative privileges to a minimal set of trusted operators.
Review MySQL accounts used by NiFi and apply least privilege at the database level.

Patch Information

Apache has released Apache NiFi 2.10.0 as the fixed version. The release replaces the prior ad-hoc identifier quoting in the CaptureChangeMySQL Processor with a more robust escaping implementation that handles the full range of MySQL identifier syntax. Refer to the Apache Mailing List Thread and the OpenWall OSS Security Update for upstream details.

Workarounds

Remove or disable the CaptureChangeMySQL Processor in flows where upgrade is not immediately feasible.
Enforce strict naming conventions on monitored MySQL databases that prohibit special characters in table names.
Restrict access to NiFi processor configuration to administrators through fine-grained policies.
Use a dedicated MySQL replication user with read-only privileges and no access to sensitive schemas.

bash

# Verify the installed Apache NiFi version and confirm upgrade to 2.10.0 or later
./bin/nifi.sh status
cat ./conf/nifi.properties | grep nifi.version

# Disable the CaptureChangeMySQL Processor via the NiFi REST API as a temporary workaround
curl -X PUT \
  -H "Content-Type: application/json" \
  -d '{"revision":{"version":0},"component":{"id":"<processor-id>","state":"STOPPED"}}' \
  https://nifi.example.com:8443/nifi-api/processors/<processor-id>/run-status