CVE-2026-81866 describes a missing authorization vulnerability (CWE-862) in Apache NiFi versions 2.9.0 through 2.11.0. The Connector configuration update and verification REST API methods allow authenticated users with write privileges on a Connector to apply Asset and Secret references without proper authorization checks on the referenced Parameter Providers or Assets. This means users can apply Secret values backed by Parameter Providers they cannot read and reference Assets not owned by the Connector. The vulnerability arises because authorization was limited to write privileges on the Connector itself, not on the referenced resources. Apache NiFi installations that do not differentiate authorization levels across Connectors and Parameter Providers are not affected. The issue is addressed in Apache NiFi 2.12.0, which adds authorization checks for read access to Parameter Providers and verifies Asset ownership during configuration updates.

An authenticated user with write privileges on a Connector but without read authorization on referenced Parameter Providers can apply Secret values from those Parameter Providers. This could lead to unauthorized use of Secrets in Connector configurations. Additionally, Assets can be referenced without verifying ownership, potentially allowing unauthorized Asset usage. The impact is limited by the requirement for authenticated users with write access to the Connector, and installations with uniform authorization across Connectors and Parameter Providers are not affected.

Upgrade Apache NiFi to version 2.12.0 or later. This version enforces read access authorization on referenced Parameter Providers and verifies that referenced Assets belong to the Connector being configured during configuration update and verification. No other mitigation actions are specified or required.