CVE-2026-62354 is an authorization vulnerability (CWE-863) in Apache NiFi from version 1.10.0 through 2.10.0. The flaw allows users with read access to submit proposed Parameter Context validation requests that override existing configuration values. This improper authorization enables these users to invoke predefined component validation methods with altered settings, potentially bypassing intended access controls. The vulnerability is mitigated in Apache NiFi 2.11.0, which enforces write access requirements for submitting Parameter Context validation requests. Systems that implement distinct authorization levels for viewing versus modifying Parameter Context configurations are not affected.

Users with read access can submit proposed Parameter values that override current configurations, potentially enabling unauthorized invocation of component validation methods with alternative settings. This could lead to unauthorized configuration validation actions that may affect system behavior or security posture. The vulnerability does not affect installations that enforce different authorization levels for viewing and modifying Parameter Context configurations.

Upgrade Apache NiFi to version 2.11.0 or later, where submitting Parameter Context validation requests requires write access. This upgrade effectively mitigates the vulnerability. If upgrading is not immediately possible, ensure that authorization policies differentiate between viewing and modifying Parameter Context configurations to prevent exploitation.