Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL
GHSA-chxj-gxww-q98w · BIT-nifi-2026-44913 · CVE-2026-44913
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not cover additional strategies. Apache NiFi installations that do not use the CaptureChangeMySQL Processor are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which incorporates more robust identifier escaping.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-44913
- WEB https://github.com/apache/nifi/pull/11206
- WEB https://github.com/apache/nifi/commit/c9fd0be0ca428408137c70937761b46f95de5959
- PACKAGE https://github.com/apache/nifi
- WEB https://issues.apache.org/jira/browse/NIFI-15905
- WEB https://lists.apache.org/thread/c8vkt5rz4dqql6sjxgrr3zdkbt1sfmsl
- WEB http://www.openwall.com/lists/oss-security/2026/06/20/5
Ready to move
Start Securing
Free, no credit card | First findings in minutes