Incorrect authorization for Parameter Context validation in Apache NiFi (CVE-2026-62354)

Apache NiFi incorrectly authorizes Parameter Context validation requests, allowing clients with only read access to submit proposed Parameter values that override current configuration. This enables read-only users to invoke predefined component validation methods with alternative settings, effectively bypassing write access controls. Installations that enforce distinct authorization levels for viewing versus modifying Parameter Context configuration are not affected. Affected versions: - Apache NiFi (org.apache.nifi:nifi-web-api) 1.10.0 through 2.10.0 We recommend updating to: Apache NiFi 2.11.0. CVSS 7.7 · our assessment: this_week Reference: https://seclists.org/oss-sec/2026/q3/397 Details: https://vuln.today/cve/CVE-2026-62354