CVE-2026-54665: Apache NiFi Host Header Vulnerability

CVE-2026-54665 Overview

CVE-2026-54665 affects Apache NiFi versions 0.0.1 through 2.9.0 and stems from missing validation on proxy-related HTTP request headers. The application builds qualified URLs from headers such as X-ProxyHost and X-Forwarded-Host without confirming the supplied values against the nifi.web.proxy.host allowlist. While Apache NiFi 1.6.0 introduced Host header validation, the control was never extended to alternative proxy and forwarded headers. An unauthenticated network attacker can manipulate these headers to coerce Apache NiFi web services into producing invalid qualified URLs for redirects or data references. The issue is tracked under CWE-346: Origin Validation Error.

Critical Impact
Attackers can manipulate proxy headers to force Apache NiFi to generate attacker-controlled qualified URLs, enabling open redirect and data reference manipulation against authenticated users.

Affected Products

Apache NiFi 0.0.1 through 2.9.0
Apache NiFi deployments without HTTPS-enforced proxy header validation
Apache NiFi instances exposed behind reverse proxies that forward unfiltered client headers

Discovery Timeline

2026-06-22 - CVE-2026-54665 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-54665

Vulnerability Analysis

Apache NiFi web services construct qualified URLs by reading the HTTP Host header or one of several alternatives, including X-ProxyHost and X-Forwarded-Host. These alternatives exist so NiFi can operate correctly behind reverse proxies that rewrite the original Host. The nifi.web.proxy.host application property defines the set of allowed host values. Before this fix, that allowlist was only enforced against the standard Host header.

Because the proxy and forwarded headers bypassed the allowlist, a remote client could submit a crafted request with an arbitrary value in X-ProxyHost or X-Forwarded-Host. NiFi then incorporated the attacker-supplied value into generated URLs used for HTTP redirection and resource references. Downstream clients following those URLs could be directed to attacker-controlled hosts, enabling phishing, credential interception in chained flows, or manipulation of integration callbacks.

Root Cause

The root cause is incomplete origin validation. The validation routine introduced in Apache NiFi 1.6.0 covered only the canonical Host header. Alternative headers used to derive the effective host were never passed through the same allowlist check defined by nifi.web.proxy.host, leaving the URL construction logic trusting unvalidated client input.

Attack Vector

The vulnerability is exploited over the network without authentication. An attacker sends an HTTP request to an exposed Apache NiFi instance and sets X-ProxyHost or X-Forwarded-Host to a malicious hostname. NiFi consumes the header value when assembling absolute URLs, producing responses that redirect or reference the attacker-controlled host. The technique works whether NiFi is reached directly or through a reverse proxy that forwards client headers without filtering.

The vulnerability mechanism is described in the Apache mailing list announcement. See the Apache Mailing List Discussion and the OpenWall OSS-Security Update for vendor-provided technical details.

Detection Methods for CVE-2026-54665

Indicators of Compromise

HTTP requests to Apache NiFi endpoints containing X-ProxyHost or X-Forwarded-Host headers with values that do not match the configured nifi.web.proxy.host allowlist.
Outbound redirect responses (3xx) from NiFi pointing to unexpected external hostnames.
NiFi-generated URLs in logs or downstream integrations referencing hosts outside the approved proxy host list.

Detection Strategies

Inspect reverse proxy and web access logs for inbound requests carrying X-ProxyHost, X-Forwarded-Host, or Forwarded headers from untrusted sources.
Compare host values observed in proxy headers against the nifi.web.proxy.host configured allowlist and alert on mismatches.
Monitor NiFi audit logs for redirect responses where the Location header references a domain outside the organization's allowed hosts.

Monitoring Recommendations

Centralize Apache NiFi access logs and reverse proxy logs into a SIEM for correlation against the allowlist.
Establish alerts for unauthenticated requests that include proxy or forwarded headers when NiFi is not deployed behind a known proxy.
Track the upgrade state of all Apache NiFi instances and flag any still running versions 0.0.1 through 2.9.0.

How to Mitigate CVE-2026-54665

Immediate Actions Required

Upgrade Apache NiFi to version 2.10.0, which validates X-ProxyHost and X-Forwarded-Host against the nifi.web.proxy.host property.
Configure Apache NiFi with HTTPS, which is required for proxy header validation to be enforced.
Restrict NiFi exposure to trusted networks and require requests to traverse a hardened reverse proxy.

Patch Information

Apache has released Apache NiFi 2.10.0 to address CVE-2026-54665. The patch extends Host header validation to the X-ProxyHost and X-Forwarded-Host headers using the existing nifi.web.proxy.host property. Validation activates only when the application is configured for HTTPS. Refer to the Apache Mailing List Discussion for the official advisory.

Workarounds

Configure the upstream reverse proxy to strip or overwrite X-ProxyHost, X-Forwarded-Host, and Forwarded headers from inbound client requests.
Define an explicit allowlist on the reverse proxy and reject requests whose forwarded host values fall outside that list.
Enforce HTTPS termination at the proxy and set fixed, trusted values for forwarded host headers before passing traffic to Apache NiFi.

bash

# Configuration example - nifi.properties
nifi.web.https.host=nifi.example.com
nifi.web.https.port=8443
nifi.web.proxy.host=nifi.example.com:8443,proxy.example.com:443