CVE-2026-68979: CWE-862 Missing Authorization in Apache Software Foundation Apache NiFi
Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization was limited to read and write privileges on the Parameter Context itself. As a result of the missing authorization, an authenticated user authorized to modify a Parameter Context, but not authorized on referencing components, could alter Parameter values affecting those components. In deployments where a Parameter value contains executable scripting content, updating a Parameter can result in code execution during automatic component validation, without starting the referencing component. The impact was limited to stopped components by existing verification checks, and the issue applies only to deployments that use component-level authorization policies. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which aligns the Parameter Context update method authorization with other methods, adding authorization checking on affected components.
AI Analysis
Technical Summary
CVE-2026-68979 describes a missing authorization vulnerability (CWE-862) in Apache NiFi's Parameter Context update REST API method in versions 1.10.0 through 2.10.0. The API does not enforce authorization on components referencing Parameter values, allowing an authenticated user authorized to modify Parameter Contexts but not the referencing components to alter parameter values. This can cause code execution during automatic validation if parameters contain executable scripting content, without needing to start the referencing components. The vulnerability is constrained by existing verification checks to stopped components and applies only when component-level authorization policies are in use. The issue is fixed in Apache NiFi 2.11.0 by aligning authorization checks on Parameter Context updates with other methods.
Potential Impact
An authenticated user with permission to modify Parameter Contexts but lacking authorization on referencing components can change parameter values affecting those components. In cases where parameters include executable scripts, this can lead to code execution during automatic validation, even if the components are stopped. The impact is limited by existing verification checks and only applies in deployments using component-level authorization policies. There are no known exploits in the wild. The CVSS 4.0 score is 5.9 (medium severity), reflecting the need for privileges and limited scope of impact.
Mitigation Recommendations
Upgrade to Apache NiFi version 2.11.0 or later, which includes proper authorization checks on components referencing Parameter Contexts during updates. This fix aligns the authorization enforcement with other API methods and prevents unauthorized parameter modifications affecting referencing components. Since no official patch link or temporary fix is provided, upgrading is the recommended remediation. Patch status is not explicitly confirmed beyond the recommendation to upgrade; check the vendor advisory for the latest guidance.
CVE-2026-68979: CWE-862 Missing Authorization in Apache Software Foundation Apache NiFi
Description
Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization was limited to read and write privileges on the Parameter Context itself. As a result of the missing authorization, an authenticated user authorized to modify a Parameter Context, but not authorized on referencing components, could alter Parameter values affecting those components. In deployments where a Parameter value contains executable scripting content, updating a Parameter can result in code execution during automatic component validation, without starting the referencing component. The impact was limited to stopped components by existing verification checks, and the issue applies only to deployments that use component-level authorization policies. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which aligns the Parameter Context update method authorization with other methods, adding authorization checking on affected components.
CVSS v4.0
Score 5.9medium
Affected software
Apache Software Foundation
Apache NiFi
pkg:maven/org.apache.nifi/nifiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-68979 describes a missing authorization vulnerability (CWE-862) in Apache NiFi's Parameter Context update REST API method in versions 1.10.0 through 2.10.0. The API does not enforce authorization on components referencing Parameter values, allowing an authenticated user authorized to modify Parameter Contexts but not the referencing components to alter parameter values. This can cause code execution during automatic validation if parameters contain executable scripting content, without needing to start the referencing components. The vulnerability is constrained by existing verification checks to stopped components and applies only when component-level authorization policies are in use. The issue is fixed in Apache NiFi 2.11.0 by aligning authorization checks on Parameter Context updates with other methods.
Potential Impact
An authenticated user with permission to modify Parameter Contexts but lacking authorization on referencing components can change parameter values affecting those components. In cases where parameters include executable scripts, this can lead to code execution during automatic validation, even if the components are stopped. The impact is limited by existing verification checks and only applies in deployments using component-level authorization policies. There are no known exploits in the wild. The CVSS 4.0 score is 5.9 (medium severity), reflecting the need for privileges and limited scope of impact.
Mitigation Recommendations
Upgrade to Apache NiFi version 2.11.0 or later, which includes proper authorization checks on components referencing Parameter Contexts during updates. This fix aligns the authorization enforcement with other API methods and prevents unauthorized parameter modifications affecting referencing components. Since no official patch link or temporary fix is provided, upgrading is the recommended remediation. Patch status is not explicitly confirmed beyond the recommendation to upgrade; check the vendor advisory for the latest guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-08-01T20:11:39.050Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a70f79ebf32cb7a34248232
Added to database: 08/03/2026, 20:18:38 UTC
Last enriched: 08/11/2026, 17:58:11 UTC
Last updated: 09/17/2026, 22:01:37 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.