Apache NiFi’s Data Leak: How a High-Severity Deserialization Flaw Puts Your Asana Workflows at Risk

The Apache Software Foundation has issued a security advisory for Apache NiFi, highlighting a high-severity vulnerability tracked as CVE-2025-66524 with a CVSS score of 7.5 that affects the GetAsanaObject Processor used to integrate NiFi with Asana. According to Apache Software Foundation’s advisory, the flaw stems from how the processor handles state information, specifically unfiltered Java object serialization and deserialization without filtering.

This means that if an attacker can manipulate the state data in the cache, the NiFi processor could ingest it and enable unintended system behaviour, a risk described as serious but not easily exploitable remotely. The fix is to upgrade to NiFi version 2.7.0, which replaces Java Object serialization with JSON serialization to improve safety and validation, or alternatively remove the GetAsanaObject Processor from the nifi-asana-processors-nar bundle if upgrading is not feasible.

Published on 22 December 2025, the article notes that exploitation requires both an Apache NiFi system running GetAsanaObject and direct access to the configured cache server.