CVE-2022-26850
Insufficiently protected credentials
When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory has global read permissions. NiFi immediately moved the temporary file to the final configuration directory, which significantly limited the window of opportunity for access. NiFi 1.16.0 includes updates to replace the Login Identity Providers configuration without writing a file to the operating system temporary directory.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory has global read permissions. NiFi immediately moved the temporary file to the final configuration directory, which significantly limited the window of opportunity for access. NiFi 1.16.0 includes updates to replace the Login Identity Providers configuration without writing a file to the operating system temporary directory.
- Record
CVE-2022-26850- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-668
- Updated
- 2026-11-02
CVE List No score
Insufficiently protected credentials
When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory has global read permissions. NiFi immediately moved the temporary file to the final configuration directory, which significantly limited the window of opportunity for access. NiFi 1.16.0 includes updates to replace the Login Identity Providers configuration without writing a file to the operating system temporary directory.
- Record
CVE-2022-26850- Updated
- 2026-11-02
EUVDEUVD-2022-6155 No score
When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory has global read permissions. NiFi immediately moved the temporary file to the final configuration directory, which significantly limited the window of opportunity for access. NiFi 1.16.0 includes updates to replace the Login Identity Providers configuration without writing a file to the operating system temporary directory.
- Record
EUVD-2022-6155- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rvp4-r3g6-8hxq
Insufficiently Protected Credentials via Insecure Temporary File in org.apache.nifi:nifi-single-user-utils
Impact
org.apache.nifi.authentication.single.user.writer.StandardLoginCredentialsWriter contains a local information disclosure vulnerability due to writing credentials (username and password) to a file that is readable by all other users on unix-like systems. On unix-like systems, the system's temporary directory is shared between all users on that system. As such, files written to that directory without setting the correct file permissions can allow other users on that system to view the contents of the files written to those temporary files.
Source
An insecure temporary file is created here:
The username and password credentials are written to this file here:
Patches
The vulnerability has been patched in version 1.16.
Prerequisites
This vulnerability impacts Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.
Workarounds
Setting the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability for all operating systems.
References
- Record
GHSA-rvp4-r3g6-8hxq- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
OSVGHSA-rvp4-r3g6-8hxq
Insufficiently Protected Credentials via Insecure Temporary File in org.apache.nifi:nifi-single-user-utils
Impact
org.apache.nifi.authentication.single.user.writer.StandardLoginCredentialsWriter contains a local information disclosure vulnerability due to writing credentials (username and password) to a file that is readable by all other users on unix-like systems. On unix-like systems, the system's temporary directory is shared between all users on that system. As such, files written to that directory without setting the correct file permissions can allow other users on that system to view the contents of the files written to those temporary files.
Source
An insecure temporary file is created here:
The username and password credentials are written to this file here:
Patches
The vulnerability has been patched in version 1.16.
Prerequisites
This vulnerability impacts Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.
Workarounds
Setting the java.io.tmpdir system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability for all operating systems.
References
- Record
GHSA-rvp4-r3g6-8hxq- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-522
- Updated
- 2026-11-02
OSVBIT-nifi-2022-26850 No score
Insufficiently protected credentials
When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory has global read permissions. NiFi immediately moved the temporary file to the final configuration directory, which significantly limited the window of opportunity for access. NiFi 1.16.0 includes updates to replace the Login Identity Providers configuration without writing a file to the operating system temporary directory.
- Record
BIT-nifi-2022-26850- Updated
- 2026-11-02
OSV No score
Insufficiently protected credentials
When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory has global read permissions. NiFi immediately moved the temporary file to the final configuration directory, which significantly limited the window of opportunity for access. NiFi 1.16.0 includes updates to replace the Login Identity Providers configuration without writing a file to the operating system temporary directory.
- Record
CVE-2022-26850- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.nifi:nifi-single-user-utilsMaven |
through 1.15.3 | 1.16 |
nifiBitnami |
1.14.0 up to 1.16.0 | 1.16.0 |
org.apache.nifi:nifi-single-user-utilsMaven |
before 1.16, plus listed versions 1.14.01.15.01.15.11.15.21.15.3 |
1.16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-26850 is a medium vulnerability (CVSS 4.3) in Apache Nifi, published April 6, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.49%, the 74th percentile. Fixed in org.apache.nifi:nifi-single-user-utils 1.16.
References
nifi.apache.org/security.html
openwall.com/lists/oss-security/2022/04/06/2
github.com/JLLeitschuh/security-research/security/advisories/GHSA-rvp4-r3g6-8hxq
nvd.nist.gov/vuln/detail/CVE-2022-26850