CVE-2023-34468: Apache NiFi DBCP/HikariCP connection pool H2 JDBC code injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.8 with high EPSS and public exploitation detail, but exploitation requires an authenticated and authorized NiFi user, lowering it below critical.

What it is

The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL using the H2 driver that enables custom code execution. The fix validates the Database URL and rejects H2 JDBC locations, with upgrade to 1.22.0 or later recommended.

Impact

An attacker with valid NiFi credentials and the authorization to configure these Controller Services can execute arbitrary code in the NiFi process. This yields high confidentiality, integrity and availability impact on the affected instance.

Attack surface

Reached over the network through the NiFi UI/API by configuring a Database URL in the DBCPConnectionPool or HikariCPConnectionPool Controller Service. Authentication and authorization are required; no user interaction beyond the configuration action is needed.

Exploitation

Not listed in CISA KEV, but EPSS is high at 0.619 (99.1st percentile) and public third-party analyses and a Packet Storm entry describe the H2 connection string RCE, indicating public technical detail exists.

What to do

• Upgrade Apache NiFi to 1.22.0 or later, which validates the Database URL and rejects H2 JDBC locations.
• If immediate upgrade is not possible, restrict who can create or modify DBCPConnectionPool and HikariCPConnectionPool Controller Services to trusted administrators only.
• Audit existing Controller Services for Database URLs using the H2 driver and remove or replace them.
• Remove or block the H2 JDBC driver from the NiFi classpath where it is not operationally required.
• Monitor NiFi configuration changes to connection pool services for unexpected Database URL edits.

Detection

• Review NiFi audit logs for creation or modification of DBCPConnectionPool and HikariCPConnectionPool Controller Services, especially Database URL changes.
• Search NiFi flow configuration and flow.json.gz exports for JDBC URLs containing 'jdbc:h2:'.
• Alert on NiFi process behavior consistent with unexpected child process or command execution from the NiFi service account.
• Correlate NiFi configuration change events with subsequent outbound network connections or file writes by the NiFi process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.