Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
Apache NiFi, NiFi Registry, and Kafka UI may run unsafe code
published 1 month ago
Summary
A problem in Apache NiFi, Apache NiFi Registry, and Kafka UI could let an attacker cause the software to execute unwanted commands. The flaw has been corrected in newer releases, so updating to the latest version of each product eliminates the risk. Apply the available security updates as soon as possible.
What to do
- Update cleanstart apache-nifi to version 2.9.0-r1.
- Update cleanstart apache-nifi-registry to version 2.9.0-r1.
- Update cleanstart kafka-ui to version 1.4.2-r6.
- Update apache-nifi to version 2.9.0-r1.
- Update apache-nifi-registry to version 2.9.0-r1.
- Update kafka-ui to version 1.4.2-r6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | apache-nifi |
< 2.9.0-r1 Fix: upgrade to 2.9.0-r1
|
| CleanStart | cleanstart | apache-nifi-registry |
< 2.9.0-r1 Fix: upgrade to 2.9.0-r1
|
| CleanStart | cleanstart | kafka-ui |
< 1.4.2-r6 Fix: upgrade to 1.4.2-r6
|
| CleanStart | – | apache-nifi |
< 2.9.0-r1 Fix: upgrade to 2.9.0-r1
|
| CleanStart | – | apache-nifi-registry |
< 2.9.0-r1 Fix: upgrade to 2.9.0-r1
|
| CleanStart | – | kafka-ui |
< 1.4.2-r6 Fix: upgrade to 1.4.2-r6
|
Original advisory text
Security fix for GHSA-vxf7-qj7q-83fh applied in: apache-nifi 2.9.0-r1, apache-nifi-registry 2.9.0-r1, kafka-ui 1.4.2-r6
GHSA-vxf7-qj7q-83fh affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
Severity
3.7
Low
Timeline
Published18 Sep 2026
Updated15 Oct 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-NC72499 · OSV
Track software like this
Free during beta