CVE-2020-9491

Inadequate Encryption Strength in Apache NiFi

7.5 HighFix available

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

2.87%Up 0.4 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

Record: CVE-2020-9491
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-327
Updated: 2026-11-02

CVE List No score

Record: CVE-2020-9491
Updated: 2026-11-02

EUVDEUVD-2022-0688 No score

Record: EUVD-2022-0688
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rfmp-jvr7-hx78 7.5

Inadequate Encryption Strength in Apache NiFi

Record: GHSA-rfmp-jvr7-hx78
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-327
Updated: 2026-11-02

OSV 7.5

Record: CVE-2020-9491
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVGHSA-rfmp-jvr7-hx78 7.5

Inadequate Encryption Strength in Apache NiFi

Record: GHSA-rfmp-jvr7-hx78
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-327
Updated: 2026-11-02

OSVBIT-nifi-2020-9491 No score

Record: BIT-nifi-2020-9491
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.apache.nifi:nifi` Maven	1.2.0 to 1.11.4	1.12.0-RC1
`nifi` Bitnami	1.0.0 to 1.11.4	None known
`org.apache.nifi:nifi` Maven	1.2.0 up to 1.12.0-RC1, plus listed versions 1.10.01.11.01.11.11.11.21.11.3 Show 11 moreShow less 1.11.41.3.01.4.01.5.01.6.01.7.01.7.11.8.01.9.01.9.11.9.2	1.12.0-RC1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, products	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-9491 is a high vulnerability (CVSS 7.5) in Apache Nifi, published October 1, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.87%, the 86th percentile. Fixed in org.apache.nifi:nifi 1.12.0-RC1.