CVE-2026-68979
Received Received - Intake

Parameter Context Update Authorization Bypass in Apache NiFi

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: Apache Software Foundation

Description
Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization was limited to read and write privileges on the Parameter Context itself. As a result of the missing authorization, an authenticated user authorized to modify a Parameter Context, but not authorized on referencing components, could alter Parameter values affecting those components. In deployments where a Parameter value contains executable scripting content, updating a Parameter can result in code execution during automatic component validation, without starting the referencing component. The impact was limited to stopped components by existing verification checks, and the issue applies only to deployments that use component-level authorization policies. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which aligns the Parameter Context update method authorization with other methods, adding authorization checking on affected components.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-04
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-68979
EUVD
EUVD-2026-52418

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache nifi From 1.10.0 (inc) to 2.10.0 (inc)
apache nifi 2.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache NiFi versions 1.10.0 through 2.10.0 have a flaw in the Parameter Context update REST API. This API allows authenticated users to modify Parameter Contexts without proper authorization checks on components that reference those parameters. If a Parameter value contains executable scripting content, updating it could lead to code execution during component validation, even without starting the component. The issue only affects deployments using component-level authorization policies.

Detection Guidance

Detecting this vulnerability requires checking the Apache NiFi version and configuration. Verify if your NiFi instance is running versions 1.10.0 through 2.10.0. Check for unauthorized Parameter Context updates by reviewing logs for REST API calls modifying Parameter Contexts without proper authorization checks.

Impact Analysis

An attacker with authenticated access to modify Parameter Contexts could alter parameter values affecting other components. If those parameters contain executable code, the attacker could execute arbitrary code during component validation. This could lead to unauthorized actions, data breaches, or system compromise, depending on the deployment configuration.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches or unauthorized access to sensitive information. Such incidents may violate compliance requirements under GDPR, HIPAA, or other regulations, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately upgrade Apache NiFi to version 2.11.0 or later to address the authorization flaw. Review and restrict component-level authorization policies to ensure only authorized users can modify Parameter Contexts. Disable scripting in Parameter values if executable content is not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68979. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart