Missing authorization on Parameter Context updates in Apache NiFi (CVE-2026-68979)

Apache NiFi fails to enforce authorization checks on components that reference Parameter Context values when those contexts are updated via the REST API. An authenticated user with write access to a Parameter Context but lacking authorization on referencing components can alter parameter values affecting those components. In deployments where parameter values contain executable scripting content, this can result in code execution during automatic component validation without starting the referencing component. Affected versions: - Apache NiFi (org.apache.nifi:nifi-web-api) 1.10.0 through 2.10.0 We recommend updating to: Apache NiFi 2.11.0. CVSS 5.9 · our assessment: this_month Reference: https://seclists.org/oss-sec/2026/q3/396 Details: https://vuln.today/cve/CVE-2026-68979