Apache NiFi Missing Authorization in Parameter Context Updates CVE-2026-68979

Vulnerability Overview CVE ID: CVE-2026-68979 Vulnerability Name: Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates Severity: Medium Description: Apache NiFi versions 1.1.0.0 through 2.1.0.0 expose a REST API method for updating Parameter Contexts that fails to perform an authorization check on components referenced by the Parameter values. While updating a Parameter Context can modify parameters that affect referenced components, the framework's authorization is limited solely to read/write permissions for the Parameter Context itself. Consequently, unauthenticated or unauthorized users can alter parameter values that impact these components. Updating a Parameter containing executable script content may lead to code execution during automatic component validation, without requiring the referenced component to be started. The impact is restricted to components that are currently stopped due to existing validation checks, and this vulnerability applies only to deployments utilizing component-level authorization policies. Impact Scope Affected Versions: Apache NiFi (org.apache.nifi:nifi-web-api) 1.1.0.0 through 2.1.0.0 Remediation Recommended Action: Upgrade to Apache NiFi 2.1.0.0. This is the recommended mitigation, which aligns the authorization for the Parameter Context update method with other methods and adds authorization checks for the affected components. Additional Information Issue Tracker: This issue is being tracked as NIFI-16148. Discoverer: DOHY3ON References: - https://nifi.apache.org/ - https://www.cve.org/CVERecord?id=CVE-2026-68979 - https://issues.apache.org/jira/browse/NIFI-16148 Timeline: Reported on 2026-07-22 POC Code or Exploit Code No POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Apache NiFi Missing Authorization in Parameter Context Updates CVE-2026-68979