Dashboard / CVE-2026-44913

CVE-2026-44913

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 36/100
Published: 2026-06-22 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network

CVSS Vector Breakdown

AV: Network
AC: High
PR: High
UI: Passive
S: P
AT: Present
VC: None
VI: None
VA: None

Description

Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not cover additional strategies. Apache NiFi installations that do not use the CaptureChangeMySQL Processor are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which incorporates more robust identifier escaping.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
apache nifi 1.2.0 – 2.10.0

References & Advisories (2)

Bug Bounty Relevance

36 / 100
✓ Network accessible

CVSS Score

5.2 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Clear

EPSS — Exploitation Probability

0.65%
Raw Score 0.006460
Percentile 50.9%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00646
2026-10-28
0.00646

Intelligence Sources

nvd ref →

External Links