Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-44913: Apache NiFi CaptureChangeMySQL can run injected SQL
CVE-2026-44913 · published 4 months ago
Summary
The CaptureChangeMySQL component in Apache NiFi versions 1.2.0 through 2.9.0 does not properly protect database table names, allowing specially crafted names to insert malicious SQL commands. This could let an attacker execute unintended queries against your MySQL database if you use this processor. Upgrade to Apache NiFi 2.10.0 or later, where the escaping has been fixed, or stop using the CaptureChangeMySQL processor.
What to do
- Update nifi to version 2.10.0.
- Update org.apache.nifi:nifi-cdc-mysql-processors to version 2.10.0.
- Update apache nifi to version 2.10.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | apache | nifi |
>= 1.2.0, < 2.10.0 cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:* |
| Bitnami | – | nifi |
>= 1.2.0, < 2.10.0 Fix: upgrade to 2.10.0
|
| maven | – | org.apache.nifi:nifi-cdc-mysql-processors |
>= 1.2.0, < 2.10.0 Fix: upgrade to 2.10.0
|
Original advisory text
Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL
Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not cover additional strategies. Apache NiFi installations that do not use the CaptureChangeMySQL Processor are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which incorporates more robust identifier escaping.
References
- http://www.openwall.com/lists/oss-security/2026/06/20/5 URL
- https://lists.apache.org/thread/c8vkt5rz4dqql6sjxgrr3zdkbt1sfmsl Vendor Advisory
- https://github.com/apache/nifi/pull/11206
- https://repo.maven.apache.org/maven2 URL
- https://github.com/apache/nifi Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44913... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-44913 Vendor Advisory
- https://issues.apache.org/jira/browse/NIFI-15905
- https://github.com/apache/nifi/commit/c9fd0be0ca428408137c70937761b46f95de5959
- https://github.com/advisories/GHSA-chxj-gxww-q98w
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.5
Medium
Type
CWE-116Improper Encoding or Escaping of Output
Timeline
Published22 Jun 2026
Updated4 Nov 2026
First seen22 Jun 2026
Sources
CVE-2026-44913 · NVD
BIT-nifi-2026-44913 · OSV
GHSA-chxj-gxww-q98w · GHSA
GHSA-chxj-gxww-q98w · OSV
CVE-2026-44913 · OSV
Track software like this
Free during beta