CVE-2026-39816

Year

2026

Published

May 8, 2026

Known Affected Devices

CVSS Score

N/A

What is CVE-2026-39816?

The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0. The TinkerpopClientService supports configuration of ByteCode Submission for the Script Submission Type, enabling Groovy Script execution in the service prior to submitting the query. The missing Restricted annotation allows users without the Execute Code Permission to configure the Service in installations that use fine-grained authorization and have the optional TinkerpopClientService installed. Apache NiFi installations that do not have the nifi-other-graph-services-nar installed are not subject to this vulnerability. Upgrading to Apache NiFi 2.9.0 is the recommended mitigation.

FAQ

How severe is CVE-2026-39816?

CVE-2026-39816 has a CVSS score of N/A/10, rated as Unknown. Review the affected products list and apply vendor patches.

What does the CVSS score mean for CVE-2026-39816?

CVSS (Common Vulnerability Scoring System) rates vulnerability severity from 0.0 to 10.0. CVE-2026-39816 scores N/A/10 (Unknown). Scores 9.0–10.0 are Critical, 7.0–8.9 are High, 4.0–6.9 are Medium, and below 4.0 are Low.

Which devices are affected by CVE-2026-39816?

The list of devices confirmed to be affected by CVE-2026-39816 is shown in the "Affected Devices" section above. Check your firmware version against the vendor security advisory and apply the latest patch.

How do I fix or mitigate CVE-2026-39816?

Apply the latest firmware or software update from the vendor. Check the References section above for official advisories and patch notes. If no patch is available, consider disabling the affected feature or isolating the device from untrusted networks.