Apache NiFi Vulnerabilities Enable Authorization Bypass Attacks

Apache NiFi users should upgrade to version 2.11.0 after the project disclosed four security vulnerabilities affecting the NiFi Web API and Parameter Context authorization controls.

The flaws could enable authorization bypass, unauthorized configuration changes, validation abuse, memory exhaustion, and, in specific deployments, code execution through manipulated parameter values.

The security issues affect Apache NiFi versions 1.5.0 through 2.10.0, depending on the vulnerability. The most serious concerns involve Parameter Contexts, which store reusable configuration values for NiFi processors and related components.

Apache NiFi Vulnerabilities

CVE-2026-62354, tracked as NIFI-16112, is rated High severity and affects Apache NiFi versions 1.10.0 through 2.10.0. The flaw allowed users with read access to a Parameter Context to submit validation requests containing proposed Parameter values.

These proposed values could override current configuration settings during validation. As a result, a user with read-only access could invoke predefined component validation methods with alternative settings.

The vulnerability mainly affects environments that enforce separate read and write permissions for Parameter Contexts. Apache NiFi 2.11.0 now requires write permission to submit Parameter Context validation requests.

CVE-2026-68979, tracked as NIFI-16148, is a Medium-severity authorization flaw affecting versions 1.10.0 through 2.10.0. NiFi did not verify authorization on components that referenced values from a modified Parameter Context.

An authenticated user allowed to change a Parameter Context could update values that impacted components they were not authorized to manage.

In deployments where a Parameter contains executable script content, a change could cause code execution during the automatic validation of a stopped component.

Apache said existing verification controls limit the risk to stopped components, and exploitation requires component-level authorization policies. Apache NiFi 2.11.0 adds authorization checks for all affected components when a Parameter Context is updated.

CVE-2026-68980, tracked as NIFI-16154, is a Low-severity Asset deletion authorization issue affecting Apache NiFi versions 2.0.0 through 2.10.0.

The REST API authorized Asset deletion using a supplied Parameter Context identifier. However, it did not verify whether the Asset belonged to that Parameter Context.

This could enable a user to delete an Asset associated with another Parameter Context in environments using different authorization levels. Apache NiFi 2.11.0 now confirms Asset ownership before allowing deletion.

CVE-2026-68981, tracked as NIFI-16152, is rated High severity and affects Apache NiFi versions 1.5.0 through 2.10.0. NiFi accepted gzip-encoded REST API requests but enforced the maximum request size on the compressed payload rather than the decompressed data.

An attacker could send a small gzip-compressed request that expands significantly after decompression, causing excessive memory consumption and potentially triggering a denial-of-service condition. Apache NiFi 2.11.0 moves response compression to the Jetty Server and turns off decompression of gzip-encoded HTTP requests.

Organizations should upgrade affected Apache NiFi deployments to version 2.11.0 and review Parameter Context and component-level authorization policies.

Administrators should also examine Parameter values that contain executable scripts, particularly where stopped components can be automatically validated. The vulnerabilities were reported by mak3bread (Minseong Kim), Nguyen Van Hiep from MBBank, and D0HY30N.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.