CVE-2026-54665: Apache NiFi Header Validation Bypass (CVSS 5.3)

Technical summary

Apache NiFi constructs qualified URLs from HTTP request headers beyond the standard Host header, specifically X-ProxyHost and X-Forwarded-Host, without sufficient validation. Although NiFi 1.6.0 introduced a configurable nifi.web.proxy.host property to restrict Host header values, the validation logic was not applied to alternative proxy headers commonly used by reverse proxies and load balancers. This omission creates a CWE-346 (Origin Validation Error) condition: an unauthenticated remote client can inject arbitrary host values through these headers, causing NiFi to construct and return URLs with attacker-controlled hostnames. The vulnerability affects HTTPS environments; mitigation requires both upgrading to 2.10.0 and ensuring HTTPS is configured.

Business impact

The primary risk is URL redirection manipulation and data reference poisoning. An attacker can inject a malicious hostname into NiFi's response URLs, potentially leading users to phishing or data-exfiltration sites. In multi-tenant or highly visible deployments, this could damage user trust and facilitate credential theft. The integrity impact is localized to URL generation; confidentiality and availability are not directly affected. Organizations relying on NiFi for data pipeline orchestration may inadvertently expose workflow URLs or embed malicious references in downstream API responses if NiFi is queried by other systems.

Affected systems

All Apache NiFi installations from version 0.0.1 through 2.9.0 are affected. This includes both open-source and any enterprise distributions based on this codebase. The risk is highest in deployments where NiFi is fronted by a reverse proxy (AWS ALB, nginx, HAProxy, etc.) or sits behind a cloud load balancer, as these environments commonly forward proxy headers. Single-host, non-proxied NiFi deployments have lower exposure but remain vulnerable to direct header manipulation if the attacker can reach the NiFi web UI.

Exploitability

Exploitation requires only network access to the NiFi web interface and knowledge of how to inject HTTP headers—both low barriers. No authentication is needed, no user interaction is required beyond visiting a manipulated URL, and the attack succeeds on any NiFi version through 2.9.0. However, real-world impact depends on whether the generated URLs are actually used (embedded in HTML responses, redirects, or API payloads). A reverse proxy that filters or overwrites proxy headers can prevent the attack upstream, significantly reducing exploitability in practice.

Remediation

Upgrade to Apache NiFi 2.10.0 or later, which validates X-ProxyHost and X-Forwarded-Host headers against the configured nifi.web.proxy.host allowlist. Upgrading alone is not sufficient: the application must be configured with HTTPS enabled. Additionally, configure nifi.web.proxy.host to explicitly list only the allowed proxy hostnames. As a defense-in-depth measure, ensure reverse proxies in front of NiFi filter and whitelist proxy headers, stripping or overwriting any untrusted values from external requests.

Patch guidance

1. Upgrade Apache NiFi to version 2.10.0 or later. Verify the upgrade through the NiFi web UI or by checking nifi-env.sh for the new version number. 2. Review and configure nifi.web.proxy.host in the nifi.properties file to include only authorized proxy hostnames (e.g., 'nifi.web.proxy.host=proxy.company.com,10.0.1.50'). 3. Ensure HTTPS is configured in nifi.properties; header validation is only active in HTTPS mode. 4. Restart the NiFi service. 5. Configure upstream reverse proxies to filter proxy headers: set strict whitelist rules for X-Forwarded-For, X-Forwarded-Host, and X-ProxyHost, removing or overwriting any values not from trusted internal proxies.

Detection guidance

Monitor NiFi access logs for suspicious X-ProxyHost or X-Forwarded-Host headers containing unexpected hostnames or domains. Look for patterns such as headers containing external domains, IP addresses not in your allow-list, or encoded special characters. In reverse proxies (nginx, Apache, HAProxy), enable detailed logging of request headers and alert on headers that do not match expected patterns. Check NiFi responses for embedded URLs: if your monitoring or SIEM system can parse NiFi API or UI responses, look for URLs with hostnames that differ from your canonical NiFi hostname. Correlate suspicious headers with actual HTTP redirects or URL embeddings in responses to confirm exploitation attempts.

Why prioritize this

This vulnerability merits prompt but not emergency action. The CVSS 3.1 score of 5.3 (Medium) reflects low attack complexity and no authentication requirement, but limited integrity impact. The threat is real in internet-facing or proxy-fronted NiFi deployments, yet many organizations operate NiFi in segmented networks where header injection risk is lower. Prioritize upgrades for NiFi instances exposed to untrusted networks or hosting sensitive data pipelines. Organizations with mature reverse proxy filtering may safely schedule the upgrade in the next maintenance window rather than emergency patching.

Risk score, explained

CVSS 3.1 score of 5.3 reflects: Attack Vector (Network), Attack Complexity (Low), Privileges Required (None), and User Interaction (None)—all favorable to the attacker. However, Scope is Unchanged and Confidentiality Impact is None, limiting severity. The Integrity impact is Low because the vulnerability affects only URL generation, not data exposure or authentication bypass. Organizations in highly regulated industries or with public-facing NiFi may weight the reputational or compliance risk higher than the base CVSS suggests.

Frequently asked questions