The CaptureChangeMySQL processor in Apache NiFi versions 1.2.0 through 2.9.0 fails to properly escape database table names used in constructing SQL statements. This flaw allows an attacker to craft table names that inject arbitrary SQL commands into the statements generated by the processor. If the NiFi instance runs with database credentials that have high privileges, the attacker could potentially alter data, read sensitive information, or disrupt database operations.

Apache NiFi versions 1.2.0 through 2.9.0 that employ the CaptureChangeMySQL processor. Systems that do not use this processor are not affected. Upgrading to 2.10.0 or later fixes the issue.

The CVSS score of 5.2 indicates a medium severity vulnerability. The EPSS score is not available, so the current likelihood of exploitation is unclear. It is not listed in the CISA KEV catalog. Because the injection occurs through the CaptureChangeMySQL processor, an attacker would need to influence the processor configuration or the data that triggers it. If the NiFi instance is exposed to untrusted input or allows users to specify table names, the attack could be launched remotely; otherwise, the attack vector is more limited to local or privileged users.