CVE-2026-81866: Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration

<p>Posted by David Handermann on Sep 16</p>Severity: Low <br /> <br /> Affected versions:<br /> <br /> - Apache NiFi (org.apache.nifi:nifi-web-api) 2.9.0 through 2.11.0<br /> <br /> Description:<br /> <br /> Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not <br /> enforce authorization checking on Assets and Secrets referenced in