A missing authorization vulnerability in the Apache NiFi TinkerpopClientService extension affects versions 2.0.0-M1 through 2.8.0, allowing users without code execution rights to configure sensitive services and potentially execute arbitrary code.

This is a missing authorization flaw (CWE-862) occurring within the optional TinkerpopClientService extension. The component allows configuration of Groovy script execution without proper privilege validation, requiring high privileges (PR:H) from an authenticated user.

A successful exploit allows unauthorized users to execute arbitrary code within the context of the Apache NiFi service, leading to potential total compromise of system confidentiality, integrity, and availability. With a CVSS score of 8.8, this high-severity flaw poses a severe risk to organizational data and operational infrastructure if fine-grained authorizations are bypassed.

Immediate Action: Update Apache NiFi to version 2.9.0 or later, or upgrade the Maven package org.apache.nifi:nifi-other-graph-services-nar to version 2.9.0.

Proactive Monitoring: Monitor system logs for unauthorized configuration changes to the TinkerpopClientService and review execution logs for anomalous Groovy script activity.

Compensating Controls: Restrict administrative access to fine-grained authorization settings and disable the optional TinkerpopClientService extension if it is not required for operational workflows.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub (https://github.com/ZeroPathAI/nifi-CVE-2026-39816-poc).

Given the high CVSS severity score of 8.8 and the availability of a public proof-of-concept, administrators must prioritize mitigating this issue immediately. Applying the vendor-supplied update to version 2.9.0 is critical to preventing potential remote code execution and maintaining secure cluster operations.