High severity7.2NVD Advisory· Published Jun 22, 2026· Updated Jun 23, 2026
CVE-2026-44913
CVE-2026-44913
Description
Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. Manual quoted boundaries added in Apache NiFi 1.8.0 narrowed the scope of potential injection options, but did not cover additional strategies. Apache NiFi installations that do not use the CaptureChangeMySQL Processor are not subject to this vulnerability. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which incorporates more robust identifier escaping.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.nifi:nifi-cdc-mysql-processorsMaven | >= 1.2.0, < 2.10.0 | 2.10.0 |
Affected products
5- Range: 1.2.0 - 2.9.0
Patches
Vulnerability mechanics
References
7- www.openwall.com/lists/oss-security/2026/06/20/5nvdThird Party AdvisoryMailing ListWEB
- github.com/advisories/GHSA-chxj-gxww-q98wghsaADVISORY
- lists.apache.org/thread/c8vkt5rz4dqql6sjxgrr3zdkbt1sfmslnvdVendor AdvisoryMailing ListWEB
- nvd.nist.gov/vuln/detail/CVE-2026-44913ghsaADVISORY
- github.com/apache/nifi/commit/c9fd0be0ca428408137c70937761b46f95de5959ghsaWEB
- github.com/apache/nifi/pull/11206ghsaWEB
- issues.apache.org/jira/browse/NIFI-15905ghsaWEB
News mentions
1- Apache NiFi: Three CVEs Disclosed Together — Auth Bypass, SQLi, and Host-Header InjectionVypr Intelligence · Jun 22, 2026