CVE-2026-44913: Apache NiFi CaptureChangeMySQL SQL Injection Vulnerability

Technical summary

The CaptureChangeMySQL Processor in NiFi constructs SQL statements dynamically using table names sourced from configuration or external input without sufficient escaping. An attacker with elevated privileges can craft malicious table identifiers that break out of intended quoting mechanisms and inject arbitrary SQL. Although NiFi 1.8.0 added manual quoted boundaries as a defensive layer, this approach was incomplete and did not account for alternative injection vectors. The vulnerability requires high privileges to exploit, which significantly constrains the attack surface. Version 2.10.0 implements more comprehensive identifier escaping that neutralizes known injection patterns.

Business impact

Organizations relying on CaptureChangeMySQL for database change tracking face data confidentiality, integrity, and availability risks if an insider or highly privileged user exploits this vulnerability. An attacker could read sensitive data, modify database contents, or disrupt processing pipelines. The impact is limited to environments where this specific processor is actively deployed and configured, and requires the attacker to possess admin-level NiFi credentials. For organizations not using CaptureChangeMySQL, there is no business risk. Delayed patching extends exposure in affected deployments.

Affected systems

Apache NiFi installations running versions 1.2.0 through 2.9.0 that have the CaptureChangeMySQL Processor enabled are vulnerable. The scope is further restricted to deployments where this processor handles real database change-capture workflows. NiFi instances that do not use this processor, or that run version 2.10.0 or later, are not affected. Verify your NiFi version and review your dataflow configurations to identify active uses of CaptureChangeMySQL.

Exploitability

Exploitation requires high-privilege authentication to NiFi (CVSS:3.1 indicates PR:H, meaning privileged user role is mandatory). An attacker cannot exploit this remotely via unauthenticated access or low-privilege accounts. The barrier to exploitation is meaningful: insider threats and compromised admin accounts present the primary risk vector. No exploit code exists in public repositories, and there is no evidence of active weaponization in the wild. The vulnerability is not severe enough to warrant emergency response for organizations with strong privilege management, but it should be prioritized for patching in environments with elevated insider risk or when admin credentials are shared across multiple users.

Remediation

Upgrade Apache NiFi to version 2.10.0 or later, which incorporates robust identifier escaping that prevents the injection attack. If immediate upgrading is not feasible, disable the CaptureChangeMySQL Processor in production environments until patched. Verify after upgrade that dataflows using this processor continue to function correctly, as the escaping changes may affect edge-case configurations. Test in a staging environment first to confirm compatibility with your specific database and processor settings.

Patch guidance

Apache NiFi 2.10.0 is the recommended target version. Download from the official Apache NiFi release channels and verify artifact signatures. Review the upgrade path for your current version in the Apache NiFi documentation—most organizations can upgrade in-place, but back up your flow configuration and state beforehand. After patching, restart NiFi and validate that CaptureChangeMySQL processors resume normal operation without configuration drift. Monitor logs for any identifier-escaping anomalies during the first 24 hours post-upgrade.

Detection guidance

Monitor NiFi audit logs for CaptureChangeMySQL Processor configuration changes, particularly table name arguments containing special characters (quotes, semicolons, SQL keywords). Watch for failed or malformed SQL statements in processor logs that may indicate injection attempts. Database audit logs can reveal unexpected SQL queries or schema introspection commands executed via NiFi connections. If you suspect exploitation, compare recent dataflow configurations against version-control snapshots to identify unauthorized modifications. Correlate NiFi privilege logs with database access logs to detect high-privilege user activities that deviate from normal patterns.

Why prioritize this

Although the CVSS score of 7.2 is classified as HIGH, the privilege requirement (PR:H) significantly constrains real-world risk. Prioritize this vulnerability based on your threat model: if insider threats or admin-credential compromise are serious concerns in your environment, treat it as critical and patch immediately. For organizations with strong access controls and low insider-risk profiles, this is a standard-priority patch that should be included in the next maintenance window. The existence of a clear, simple mitigation (upgrade to 2.10.0) and the absence of known exploitation in the wild support a measured approach over panic-driven response.

Risk score, explained

CVSS 7.2 (HIGH) reflects the impact severity (all three: confidentiality, integrity, availability) balanced against the high-privilege requirement. The attack vector is network-accessible, and no user interaction is required once the attacker has admin credentials—characteristics that elevate the score. However, the privileged-user constraint prevents this from reaching a critical score (8.0+). The real-world risk for your organization depends on whether CaptureChangeMySQL is deployed and how tightly you control admin-level access. Organizations with mature privilege management and this processor unused can safely deprioritize relative to the numerical score; conversely, those with shared or loosely managed admin accounts should treat it more seriously.

Frequently asked questions