Apache NiFi versions prior to 2.11.0-r3 have a security vulnerability in the Apache ZooKeeper quorum TLS implementation where peer hostname verification is not enforced in FIPS-mode deployments. This flaw could allow an attacker to bypass hostname verification during TLS communication within the ZooKeeper quorum, potentially leading to unauthorized control or manipulation of the quorum communications. The issue is addressed in version 2.11.0-r3.
A high-severity security vulnerability in Apache NiFi affects versions prior to 2.11.0-r3. The issue involves possible memory exhaustion in SFTP clients (DefaultSftpClient) within the sshd-sftp component of Apache MINA SSHD. This vulnerability can lead to denial of service due to resource exhaustion. A patch is available in version 2.11.0-r3.
A server-side memory exhaustion vulnerability exists in Apache MINA SSHD 1 as used in the apache-nifi package. This flaw can cause denial of service by exhausting server memory resources. The vulnerability affects apache-nifi versions prior to 2.11.0-r3. A patch is available in version 2.11.0-r3 to address this issue.
A high-severity security vulnerability (CVE-2026-93994) affects Apache NiFi versions prior to 2.11.0-r3. The issue involves the Apache MINA SSHD Java library used for client-side and server-side SSH functionality. The vulnerability allows an attacker with low privileges to cause a high impact on confidentiality and integrity without requiring user interaction. A patch is available in version 2.11.0-r3.
An authentication bypass vulnerability exists in the sshd-core component of Apache MINA SSHD versions 2 used by Apache NiFi. This flaw allows an attacker to bypass authentication mechanisms, potentially gaining unauthorized access. The vulnerability is rated critical with a CVSS score of 9.1. A fixed version 2.11.0-r3 is available to address this issue.
CVE-2026-85515 is a high-severity security vulnerability affecting Apache NiFi versions prior to 2.11.0-r3. The flaw exists in the Bouncy Castle for Java library used by Apache NiFi. A fix is available in version 2.11.0-r3.
CVE-2026-71887 is a high-severity security vulnerability affecting Apache NiFi due to an issue in the Bouncy Castle for Java library versions before 1. The vulnerability impacts Apache NiFi versions prior to 2.11.0-r3. A fix is available in version 2.11.0-r3.
A high-severity security vulnerability (CVE-2026-71886) affects Apache NiFi due to an issue in the Bouncy Castle for Java library versions prior to 2.11.0-r3. This vulnerability has a CVSS 4.0 base score of 8.2, indicating a significant risk. The flaw is fixed in Apache NiFi version 2.11.0-r3.
CVE-2026-32288 is a medium severity security vulnerability in the argo-workflows package affecting versions prior to 4.1.6-r1. The flaw involves the tar component and results in an impact on availability. A fix is available in version 4.1.6-r1.
A security vulnerability (CVE-2026-32282) affects the argo-workflows package on Linux systems. The issue impacts versions prior to 4.1.6-r1. It has a CVSS score of 6.4, indicating a medium severity. The vulnerability involves a condition related to root privileges on Linux. A fix is available in version 4.1.6-r1.
A critical security vulnerability in argo-workflows affects versions prior to 4.1.6-r1. The flaw occurs during TLS session resumption when the ClientCAs or RootCAs fields in the underlying Config are changed between the initial and resumed handshake, potentially allowing a resumed handshake to succeed improperly.
A security vulnerability in argo-workflows prior to version 4.1.6-r1 allowed URLs to be improperly escaped inside a <meta> tag's <content> attribute. This flaw could lead to partial compromise of confidentiality and integrity when exploited. The issue has been fixed in version 4.1.6-r1.
A security vulnerability in the argo-workflows package was identified where context was not properly tracked across template branches for JavaScript template literals. This flaw could lead to incorrect escaping of content when branches were used, potentially causing security issues. The vulnerability affects versions prior to 4.1.6-r1 and has a medium severity rating with a CVSS score of 6.1. A fix is available in version 4.1.6-r1.
A low-severity security vulnerability exists in the argo-workflows package on Unix platforms when listing directory contents using the File functionality. This issue affects versions prior to 4.1.6-r1 and has been fixed in version 4.1.6-r1.
A security vulnerability in argo-workflows allows the ReverseProxy component to forward queries containing parameters that are not visible to Rewrite functions. This could lead to unintended processing of query parameters. The issue affects versions prior to 4.1.6-r1 and has a medium severity rating with a CVSS score of 5.3. A fix is available in version 4.1.6-r1.
A security vulnerability in the argo-workflows package allows incorrect escaping of data within <script> tags if a trusted template author uses an empty or whitespace 'type' attribute. This flaw affects versions prior to 4.1.6-r1 and could lead to partial compromise of confidentiality and integrity. A fix is available in version 4.1.6-r1.
A security vulnerability in argo-workflows affects versions prior to 4.1.6-r1. The issue arises because actions that insert URLs into the content attribute of HTML meta tags do not properly escape these URLs, potentially leading to security risks. A fix is available in version 4.1.6-r1.
A high-severity security vulnerability (CVE-2026-25679) affects the argo-workflows package versions prior to 4.1.6-r1. The flaw does not impact confidentiality or integrity but results in a high impact on availability. A patch is available in version 4.1.6-r1 to address this issue.
A security vulnerability in argo-workflows versions prior to 4.1.6-r1 allows a specially crafted long CNAME DNS response to trigger a double-free of C memory when using LookupCNAME with the cgo DNS resolver, causing a crash.
A security vulnerability in argo-workflows causes the HTTP/2 transport layer to enter an infinite loop when processing SETTINGS frames that specify a SETTINGS_MAX_FRAME_SIZE value of 0. This results in a denial of service condition due to continuous writing of CONTINUATION frames. The issue affects versions prior to 4.1.6-r1 and has been assigned CVE-2026-33814. A fix is available in version 4.1.6-r1.