CVE-2025-66524
Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires…
Technology
Apache NiFi
CVSS Score
8.8 / 10.0
Affected Versions
>=1.20.0 <2.7.0; 2.7.0
Upstream Fix
See upstream advisory
Published
December 19, 2025
OSSeva Coverage
Fixed upstream
Description
Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for storing and retrieving state information. The GetAsanaObject Processor used generic Java Object serialization and deserialization without filtering. Unfiltered Java object deserialization does not provide protection against crafted state information stored in the cache server configured for GetAsanaObject. Exploitation requires an Apache NiFi system running with the GetAsanaObject Processor, and direct access to the configured cache server. Upgrading to Apache NiFi 2.7.0 is the recommend
Is your Apache NiFi deployment affected?
If you're running >=1.20.0 <2.7.0; 2.7.0, you need this patch. Book a discovery call to get covered.