CVE-2026-68979: CWE-862 Missing Authorization in Apache Software Foundation Apache NiFi
Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization was limited to read and write privileges on the Parameter Context itself. As a result of the missing authorization, an authenticated user authorized to modify a Parameter Context, but not authorized on referencing components, could alter Parameter values affecting those components. In deployments where a Parameter value contains executable scripting content, updating a Parameter can result in code execution during automatic component validation, without starting the referencing component. The impact was limited to stopped components by existing verification checks, and the issue applies only to deployments that use component-level authorization policies. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which aligns the Parameter Context update method authorization with other methods, adding authorization checking on affected components.
AI Analysis
Technical Summary
Apache NiFi versions 1.10.0 through 2.10.0 expose a missing authorization vulnerability (CWE-862) in the Parameter Context update REST API method. The API does not enforce authorization checks on components that reference Parameter values, allowing an authenticated user with rights to modify a Parameter Context but lacking authorization on the referencing components to change Parameter values impacting those components. This can lead to code execution during automatic validation if the Parameter contains executable scripting content. The vulnerability affects stopped components and applies only in environments using component-level authorization policies. The recommended mitigation is upgrading to Apache NiFi 2.11.0, which adds proper authorization checks on affected components in the Parameter Context update method.
Potential Impact
An authenticated user with permission to modify Parameter Contexts but without authorization on referencing components can alter Parameter values affecting those components. In deployments where Parameters contain executable scripting content, this can lead to code execution during automatic component validation without starting the component. The impact is limited to stopped components and environments using component-level authorization policies. This could potentially allow unauthorized code execution within the NiFi environment.
Mitigation Recommendations
Upgrade Apache NiFi to version 2.11.0 or later, which includes authorization checks on components referencing Parameter values in the Parameter Context update REST API method. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed beyond the recommended upgrade; therefore, check the vendor advisory for the latest remediation guidance.
CVE-2026-68979: CWE-862 Missing Authorization in Apache Software Foundation Apache NiFi
Description
Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization was limited to read and write privileges on the Parameter Context itself. As a result of the missing authorization, an authenticated user authorized to modify a Parameter Context, but not authorized on referencing components, could alter Parameter values affecting those components. In deployments where a Parameter value contains executable scripting content, updating a Parameter can result in code execution during automatic component validation, without starting the referencing component. The impact was limited to stopped components by existing verification checks, and the issue applies only to deployments that use component-level authorization policies. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which aligns the Parameter Context update method authorization with other methods, adding authorization checking on affected components.
CVSS v4.0
Score 5.9medium
Affected software
pkg:maven/org.apache.nifi/nifiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Apache NiFi versions 1.10.0 through 2.10.0 expose a missing authorization vulnerability (CWE-862) in the Parameter Context update REST API method. The API does not enforce authorization checks on components that reference Parameter values, allowing an authenticated user with rights to modify a Parameter Context but lacking authorization on the referencing components to change Parameter values impacting those components. This can lead to code execution during automatic validation if the Parameter contains executable scripting content. The vulnerability affects stopped components and applies only in environments using component-level authorization policies. The recommended mitigation is upgrading to Apache NiFi 2.11.0, which adds proper authorization checks on affected components in the Parameter Context update method.
Potential Impact
An authenticated user with permission to modify Parameter Contexts but without authorization on referencing components can alter Parameter values affecting those components. In deployments where Parameters contain executable scripting content, this can lead to code execution during automatic component validation without starting the component. The impact is limited to stopped components and environments using component-level authorization policies. This could potentially allow unauthorized code execution within the NiFi environment.
Mitigation Recommendations
Upgrade Apache NiFi to version 2.11.0 or later, which includes authorization checks on components referencing Parameter values in the Parameter Context update REST API method. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed beyond the recommended upgrade; therefore, check the vendor advisory for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-08-01T20:11:39.050Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a70f79ebf32cb7a34248232
Added to database: 08/03/2026, 20:18:38 UTC
Last enriched: 08/03/2026, 20:36:33 UTC
Last updated: 08/03/2026, 21:18:55 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.