CVE-2026-87976: Apache NiFi Registry Path Traversal Flaw

CVE-2026-87976 Overview

CVE-2026-87976 is a path traversal vulnerability in Apache NiFi Registry versions 0.4.0 through 2.11.0. The flaw exists in the default file persistence provider, which uses group, artifact, and version coordinates from uploaded NAR (NiFi Archive) manifests as filesystem path components. The provider does not reject parent-directory names, and the path-containment check compares an unnormalized resolved path. An authenticated user with write and delete permissions on a bucket can upload a NAR with crafted manifest coordinates that trigger file system operations outside the persistence directory. The issue is tracked as CWE-22 (Path Traversal).

Critical Impact
Authenticated attackers with bundle write and delete privileges can write to or delete files outside the file persistence directory, compromising integrity and availability of the Registry host.

Affected Products

Apache NiFi Registry 0.4.0 through 2.11.0
Deployments using the default file persistence provider for extension bundles
Fixed in Apache NiFi Registry 2.12.0

Discovery Timeline

2026-09-16 - CVE-2026-87976 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87976

Vulnerability Analysis

Apache NiFi Registry stores extension bundles on disk using a file persistence provider. When a user uploads a NAR bundle, the provider derives the storage path from the Maven-style coordinates (group, artifact, version) declared in the NAR manifest. These attacker-controlled values are joined into a filesystem path without sanitization.

The provider fails on two controls. First, it does not reject coordinates that contain parent-directory tokens such as ... Second, the path-containment check that verifies the resolved location remains inside the storage root compares the unnormalized resolved path. An attacker can therefore construct coordinates whose normalized filesystem location escapes the intended storage root while still passing the flawed containment check.

An authenticated user with bundle write and delete authorization in a bucket can upload a NAR whose manifest coordinates traverse outside the file persistence directory. Both write and delete operations follow that traversed path, allowing arbitrary file creation, overwrite, or removal within the privileges of the Registry service account.

Root Cause

The root cause is untrusted input concatenation with an incomplete containment check. The persistence layer treats manifest coordinates as safe path components and validates containment using a string comparison against an unnormalized resolved path, so canonical traversal sequences bypass the guard.

Attack Vector

Exploitation requires network access to the Registry API and an authenticated account with permission to write and delete bundles in at least one bucket. The attacker crafts a NAR manifest whose group, artifact, or version field embeds parent-directory sequences. Uploading the bundle causes the persistence provider to perform filesystem operations outside the configured storage root. Refer to the Apache Mailing List Thread and the OpenWall OSS Security Update for advisory details.

Detection Methods for CVE-2026-87976

Indicators of Compromise

NAR bundle upload events where manifest group, artifact, or version fields contain .., path separators, or absolute path prefixes.
Files created, modified, or deleted by the NiFi Registry process user outside the configured file persistence directory.
Unexpected POST requests to the bundle upload endpoint followed by errors referencing paths outside the storage root.

Detection Strategies

Audit Registry access logs for bundle write and delete operations performed by non-administrative users, correlating with upload payload metadata.
Inspect the file persistence directory and its parent paths for files with names matching Maven coordinate patterns that include traversal tokens.
Enable filesystem auditing on the Registry host to flag write and unlink operations by the Registry service account outside the declared storage root.

Monitoring Recommendations

Forward Registry application logs and host filesystem telemetry to a centralized analytics platform for correlation across upload events and disk activity.
Alert on any process running as the Registry service account that modifies files outside the persistence directory or under system configuration paths.
Track authenticated user actions on buckets, focusing on accounts newly granted write and delete permissions on extension bundles.

How to Mitigate CVE-2026-87976

Immediate Actions Required

Upgrade Apache NiFi Registry to version 2.12.0, which rejects parent-directory coordinates and enforces a normalized path check against the storage root.
Revoke bundle write and delete authorization from accounts that do not require it, reducing the population of users able to trigger the flaw.
Review the file persistence directory and parent paths for unauthorized files created before the upgrade.

Patch Information

Apache NiFi Registry 2.12.0 is the recommended fix. The release rejects group, artifact, and version values that contain parent-directory names and requires the normalized resolved path to remain a strict child of the storage root. Consult the Apache Mailing List Thread for release details.

Workarounds

Restrict bucket write and delete permissions to trusted administrators until the upgrade to 2.12.0 is complete.
Run the NiFi Registry process under a dedicated low-privilege user account with filesystem access limited to the persistence directory.
Place the Registry API behind network controls that limit access to authenticated administrators from trusted networks only.

bash

# Configuration example
# Verify installed Apache NiFi Registry version and upgrade path
./bin/nifi-registry.sh --version
# Expected output after remediation: Apache NiFi Registry 2.12.0 or later