CVE-2026-62354
Received Received - Intake

Authorization Bypass in Apache NiFi Parameter Context

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: Apache Software Foundation

Description
Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying Parameter Context configuration are not subject to this vulnerability. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, requiring write access to submit Parameter Context validation requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-04
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-62354
EUVD
EUVD-2026-52420

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache nifi From 1.10.0 (inc) to 2.10.0 (inc)
apache nifi 2.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache NiFi 1.10.0 through 2.10.0 allows users with read access to submit proposed Parameter Context values that override current configurations. This enables them to invoke predefined component validation methods with alternative settings.

Detection Guidance

This vulnerability can be detected by checking Apache NiFi versions between 1.10.0 and 2.10.0. Use commands like 'nifi.sh status' or check the NiFi UI under 'About Apache NiFi' to verify the version. Look for unauthorized Parameter Context validation requests in logs.

Impact Analysis

Users with read access could modify Parameter Context configurations, potentially causing unintended behavior or security issues in the NiFi instance. This could lead to data corruption, unauthorized access, or service disruptions.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modifications to configurations that may handle sensitive data. It may violate principles of least privilege and data integrity required by GDPR and HIPAA.

Mitigation Strategies

Immediately upgrade to Apache NiFi 2.11.0 or later. Ensure different authorization levels are set for viewing and modifying Parameter Context configurations. Restrict write access to only authorized users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62354. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart