CVE-2026-68980
Received Received - Intake

Improper Authorization in Apache NiFi Parameter Context Asset Deletion

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: Apache Software Foundation

Description
Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework performed authorized based on the supplied Parameter Context Identifier without verifying the requested Identifier against the stored Identifier. Apache NiFi installations that do not implement different levels of authorization across Parameter Contexts are not subject to this vulnerability, because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which verifies Parameter Context ownership of the requested Asset before deletion using the same strategy applied to Asset read operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-04
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-68980
EUVD
EUVD-2026-52421

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache nifi From 2.0.0 (inc) to 2.10.0 (inc)
apache nifi 2.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Apache NiFi versions 2.0.0 to 2.10.0 have an authorization flaw in their REST API. When deleting assets linked to Parameter Contexts, the system checks permissions using the supplied Parameter Context Identifier but fails to verify if the asset actually belongs to that context. This allows unauthorized deletion if different Parameter Contexts have varying authorization levels.

Impact Analysis

If your NiFi instance has multiple Parameter Contexts with different access levels, an attacker with access to one context could delete assets from another context. This could lead to data loss or disruption of configured workflows. Systems without differentiated authorization are not affected.

Mitigation Strategies

Upgrade to Apache NiFi 2.11.0 or later to address the vulnerability by verifying Parameter Context ownership of requested Assets before deletion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68980. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart