CVE-2026-44914 is a missing authorization vulnerability in Apache NiFi affecting versions 1.12.0 through 2.9.0. The issue arises when replacing Process Groups containing extension components annotated as Restricted, which require additional privileges. The NiFi framework failed to check the Restricted status during these replacement requests, allowing users with general write permissions to add Restricted components improperly. Installations that enforce specific authorization for Restricted components are not vulnerable because the security boundary is maintained by write permissions. The vulnerability is addressed by upgrading to version 2.9.0, where the Restricted status authorization implementation is removed from the framework.

An attacker with general write access to Apache NiFi could exploit this vulnerability to add components that require higher privileges (Restricted components) without proper authorization checks. This could lead to unauthorized use of sensitive or privileged components within the NiFi environment. However, installations that have implemented specific authorization controls for Restricted components are not affected. There are no known exploits in the wild at this time.

Upgrade Apache NiFi to version 2.9.0 or later, which removes the Restricted status authorization implementation from the framework, effectively mitigating this vulnerability. No official patch or temporary fix is indicated other than upgrading. If specific authorization for Restricted components is already implemented, the system is not vulnerable.