Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-68980— Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion

CVSS 2.3 · Low EPSS 0.26% · P18

Possible ATT&CK Techniques 1AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProductVersion RangeStatus
Apache Software FoundationApache NiFi2.0.0≤ 2.10.0affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-68980

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion
Source: CVE Program / CVE List V5
Vulnerability Description
Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework performed authorized based on the supplied Parameter Context Identifier without verifying the requested Identifier against the stored Identifier. Apache NiFi installations that do not implement different levels of authorization across Parameter Contexts are not subject to this vulnerability, because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which verifies Parameter Context ownership of the requested Asset before deletion using the same strategy applied to Asset read operations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:L/U:Clear
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

VendorProductAffected VersionsCPESubscribe
Apache Software FoundationApache NiFi 2.0.0 ~ 2.10.0 -

II. Public POCs for CVE-2026-68980

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-68980

请登录查看更多情报信息。

Mailing List Discussions for CVE-2026-68980 (1)

Same Patch Batch · Apache Software Foundation · 2026-08-03 · 5 CVEs total

CVE-2026-689818.8 HIGHApache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
CVE-2026-623547.7 HIGHApache NiFi: Incorrect Authorization for Parameter Context Validation Requests
CVE-2026-689795.9 MEDIUMApache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates
CVE-2026-61372Apache Jena Fuseki: Web requests using SPARQL Update can escape file restrictions

IV. Related Vulnerabilities

Same product: Apache NiFi
Same vendor: Apache Software Foundation
Same weakness: CWE-863

V. Comments for CVE-2026-68980

No comments yet

Leave a comment