The vulnerability stems from the optional TinkerpopClientService component lacking a Restricted annotation that would enforce the Execute Code permission. Consequently, users without explicit code‑execution rights can create or modify this service, specify Groovy script bytecode, and have the NiFi process execute arbitrary code. The result is an elevation of privilege that can lead to full system compromise, data exfiltration, or further lateral movement within the environment.

This issue affects Apache NiFi versions from 2.0.0‑M1 up to 2.8.0 when the optional nifi‑other‑graph‑services‑nar component is installed. Installations that do not include this component are not impacted.

With a CVSS score of 7.5, the vulnerability is considered high severity. EPSS is not available, and the weakness is not listed in CISA’s KEV catalog. The likely attack vector involves an attacker who can access NiFi’s configuration interface or controller service API, exploiting the missing permission check to reconfigure the TinkerpopClientService and execute Groovy scripts under the NiFi process context.