Apache NiFi 2.8.0 — EXECUTE_CODE Permission Bypass to Groovy RCE (CVE-2026-39816)

Metadata

Affected Target

Summary

Apache NiFi restricts all of its 16 dedicated script-execution processors behind an EXECUTE_CODE permission, enforced via a @Restricted annotation. However, the optional graph bundle’s TinkerpopClientService — used by the ExecuteGraphQuery / ExecuteGraphQueryRecord processors — implements its own Groovy-based “bytecode submission” code path that is missing this annotation. A flow designer who has read/write access to build pipelines but has been deliberately denied EXECUTE_CODE can still configure a TinkerpopClientService and an ExecuteGraphQuery processor with arbitrary Groovy in the “Graph Query” property; starting the processor compiles and executes that Groovy directly in the NiFi JVM, bypassing the intended security boundary entirely.

Vulnerability Details

Root Cause

TinkerpopClientService.bytecodeSubmission() (in nifi-other-graph-services) compiles and runs an attacker-supplied Groovy string via groovyShell.parse(s) / compiled.run() with no sanitization, allowlist, or sandboxing, and neither this service nor the processors that drive it carry the @Restricted(requiredPermission = EXECUTE_CODE) annotation applied to every other scripting component (CWE-95).

Attack Vector

1. As a user with flow-designer permissions (process-group and /controller read/write) but explicitly without EXECUTE_CODE, configure a TinkerpopClientService controller service in “ByteCode Submission” mode, pointing at any reachable Gremlin server (used only for initialization).
2. Create an ExecuteGraphQuery processor and place attacker-controlled Groovy code in its “Graph Query” property.
3. Start the processor; NiFi compiles and executes the Groovy in the NiFi service account’s JVM context on its own timer, with no upstream connection or FlowFile content required.
4. Use the resulting code execution to read secrets, pivot to connected systems, or establish persistence.

Impact

Arbitrary code execution as the NiFi service account, exposing the keystore, sensitive properties key, flow-encrypted secrets, and any downstream systems reachable from NiFi (databases, message buses, object storage) — precisely the access EXECUTE_CODE is meant to gate.

Environment / Lab Setup

Target:   Apache NiFi 2.8.0 with nifi-other-graph-services-nar installed
Attacker: Docker, Python 3.10+, uv

Proof of Concept

PoC Script

See pocs/flow_designer_groovy_rce.py (exploit) and setup/setup.sh / setup/docker-compose.yml / setup/teardown.sh (lab environment) in this folder.

1
2
3
4
5
6
7
8
9

cd setup
./setup.sh

uv run --no-project --with requests \
    ../pocs/flow_designer_groovy_rce.py \
    --base-url https://localhost:8443 \
    --username flow_designer \
    --password 'flowDesigner123!' \
    --gremlin-host gremlin-server

The script authenticates as a restricted flow_designer user, first confirms ExecuteScript is correctly denied by the EXECUTE_CODE gate, then creates a TinkerpopClientService + ExecuteGraphQuery processor with Groovy that spawns a reverse shell, upgrading it to a fully interactive PTY-backed session inside the NiFi container.

Detection & Indicators of Compromise

Signs of compromise:

• Creation or modification of TinkerpopClientService / ExecuteGraphQuery components by non-privileged flow-designer accounts
• Unexpected outbound shell connections originating from the NiFi host process

Remediation

References

• Source repository
• ZeroPath technical write-up

Notes

Mirrored from https://github.com/ZeroPathAI/nifi-CVE-2026-39816-poc on 2026-07-05.