Submit finding

All findings

CVE-2026-39816 high

ZeroPath finds Apache NiFi Execute Code permission bypass CVE-2026-39816

ZeroPath Research disclosed an Apache NiFi authorization flaw where users without EXECUTE_CODE can run code through TinkerpopClientService when optional graph extensions are installed.

Bug class
Authorization bypass leading to server-side code execution
Affected codebase
Apache NiFi
Credited system
ZeroPath AI SAST
Disclosed
May 7, 2026
Attribution
Self-reported attribution
Severity
high
Source status: ZeroPath's May 7, 2026 research post supplies the discovery and LLM-assisted workflow attribution. Apache NiFi's security page, oss-security announcement, Jira issue, and NVD record corroborate the vulnerability, reporter, affected versions, fixed version, and high severity.

Summary

ZeroPath Research disclosed CVE-2026-39816 in Apache NiFi. The issue affects NiFi 2.0.0-M1 through 2.8.0 when the optional nifi-other-graph-services-nar extension is installed. In that configuration, users without the EXECUTE_CODE permission can configure TinkerpopClientService in a way that executes Groovy code before submitting a graph query.

Apache’s advisory text describes the root cause as a missing restricted annotation for the Execute Code Required Permission. NiFi 2.9.0 contains the fix, and Apache recommends upgrading.

Attribution

This entry is labeled self-reported. The Apache advisory and oss-security post credit John Walker from ZeroPath as the finder, and they confirm the affected versions and fixed release. ZeroPath’s own write-up supplies the AI-workflow context, saying that LLMs working inside a structured scaffold made it easier to find the surprising permission boundary.

That separation matters. The vulnerability and reporter are independently corroborated by Apache; the exact AI-assisted discovery workflow is first-party ZeroPath evidence.

Why it matters

The bug is a useful example of AI-assisted application-security discovery outside memory safety. The vulnerable path was semantic: a component that looks like a graph-query interface can become a code-execution interface under a specific TinkerPop submission mode.

Traditional source-to-sink matching is not enough to explain the bug. The finding depends on understanding NiFi’s permission model, optional extension packaging, and how TinkerPop’s Groovy-backed query flow changes the meaning of the configured permission.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.