CVE-2026-54665 Details
Description
Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header without validating the values provided. Apache NiFi 1.6.0 introduced a configurable application property to restrict values provided in the HTTP Host header, but did not apply the validation to alternative Proxy and Forwarded headers. The absence of proxy host header validation allowed a client to instruct Apache NiFi web services to construct invalid qualified URLs for redirection or data references. Upgrading to Apache NiFi 2.10.0 is the recommended mitigation, which implements validation for the X-ProxyHost and X-Forwarded-Host HTTP request headers based on the nifi.web.proxy.host property. Enabling header validation requires configuring the application with HTTPS. Reverse proxy servers in front of Apache NiFi are responsible for filtering input request headers and providing allowed values to the application.
A vulnerability exists in Apache NiFi versions 0.0.1 prior to 2.10.0, where the application builds qualified URLs from several HTTP request headers that serve as alternatives to the standard Host header, without validating the provided values. Although Apache NiFi 1.6.0 introduced a configurable property to restrict values in the HTTP Host header, this validation was not extended to alternative Proxy and Forwarded headers. The lack of validation for proxy host headers allowed clients to manipulate Apache NiFi web services into creating invalid qualified URLs for redirection or data references.
Users are advised to upgrade to Apache NiFi 2.10.0 or later, which includes validation for the X-ProxyHost and X-Forwarded-Host HTTP request headers. To enable this validation, configure the application to use HTTPS. Additionally, if a reverse proxy server is used in front of Apache NiFi, it should be set up to filter input request headers and provide only allowed values to the application.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/06/20/7 | CVE | Third Party AdvisoryMailing List |
| https://lists.apache.org/thread/y0yoblon8f6dp00qz5r90cxq5n6g4j6k | [email protected] | Vendor AdvisoryMailing List |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache nifi | >= 0.0.1, < 2.10.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | Initial Analysis | [email protected] |
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | CVE Modified | CVE |
| Jun 22, 2026 | New CVE Received | [email protected] |