Which versions of Apache NiFi are affected by CVE-2026-68979?

Apache NiFi deployments with component-level authorization controls are vulnerable to a privilege escalation flaw allowing authenticated users to bypass authorization boundaries through parameter…

How to fix or mitigate CVE-2026-68979?

Within 24 hours: inventory all NiFi deployments to identify versions prior to 2.11.0 and disable or restrict executable script parameters in affected systems. Within 7 days: apply vendor patch by upgrading all NiFi instances to version 2.11.0 or later per NIFI-16148. Within 30 days: audit component-level authorization policies and parameter context permissions to validate privilege boundaries are correctly enforced and restrict parameter write access to authorized administrative roles only.

Apache NiFi CVE-2026-68979

Q: What is the CVSS score of CVE-2026-68979?

CVE-2026-68979 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Clear. EPSS exploitation probability: 0.4%.

EUVD-2026-52418 MEDIUM

Missing Authorization (CWE-862)

2026-08-03

GHSA-p3jm-q7cw-g645

Apache RCE Authentication Bypass Nifi

5.9

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Clear

vuln.today AI

8.5 HIGH

PR:L for authenticated Parameter Context write access; AC:H because code execution requires both component-level authorization policies and scripting content in parameters; S:C because attacker crosses the component authorization boundary to affect resources outside their privilege scope.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 03, 2026 - 20:22 NVD

5.9 (MEDIUM)

Analysis Generated

Aug 03, 2026 - 20:18 vuln.today

CVE Published

Aug 03, 2026 - 19:50 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Missing authorization in Apache NiFi's Parameter Context update REST API allows an authenticated user with write access to a Parameter Context to alter parameter values that affect referencing components the user is not authorized to access. In deployments where parameter values contain executable scripting content, this privilege boundary bypass can trigger code execution during automatic component validation on stopped processors without the attacker needing to start those components. No public exploit has been identified; exploitation is bounded to deployments using component-level authorization policies and is confirmed fixed in Apache NiFi 2.11.0 per NIFI-16148.

Technical ContextAI

Apache NiFi is a data flow automation platform that centralizes configurable values through Parameter Contexts - named collections of key-value pairs that individual processors and other components reference at runtime. The REST API supporting Parameter Context updates (the multi-step update-request flow and the direct update method for stopped components) enforced authorization checks only at the Parameter Context resource level, not on the downstream components that consume those parameters. This is a Missing Authorization flaw (aligned with CWE-862) where the framework's access control evaluation stops at the resource boundary rather than propagating to dependent objects. NiFi supports a multi-tenant, component-level authorization model where different users may hold different policies on individual processors versus the Parameter Contexts they reference - the vulnerability exploits this seam. The affected artifact is org.apache.nifi:nifi-web-api, present in NiFi 1.10.0 through 2.10.0. The NIFI-16148 fix (GitHub PR #11479, resolved in 2.11.0) aligns the update method's authorization with other Parameter Context API methods by adding authorization checks on all referencing components before committing the update.

RemediationAI

Upgrade to Apache NiFi 2.11.0, which is the vendor-recommended fix and resolves NIFI-16148 by aligning Parameter Context update method authorization with all other Parameter Context API methods, ensuring that write access to referencing components is verified before any update is committed. Release artifacts are available at https://nifi.apache.org/. For deployments that cannot upgrade immediately, restricting Parameter Context write permissions exclusively to fully trusted administrators - users who already hold write access to all components that reference those contexts - eliminates the privilege boundary that the vulnerability exploits. This workaround collapses the intended separation between Parameter Context administrators and component operators and may be operationally disruptive in multi-team NiFi environments. Additionally, auditing and removing executable scripting content from parameter values reduces the worst-case impact from code execution to parameter value tampering while the upgrade is planned.