Which versions of Apache NiFi are affected by CVE-2026-68980?

Apache NiFi versions 2.0.0 through 2.10.0 contain an authorization bypass flaw that allows authenticated users to delete critical assets from restricted configuration contexts they are not authorized…

How to fix or mitigate CVE-2026-68980?

Within 24 hours, audit whether your organization runs multi-tenant Apache NiFi deployments with differentiated Parameter Context access controls; if so, immediately restrict write permissions on sensitive contexts and review deletion logs for unauthorized activity. Within 7 days, limit REST API access to trusted networks, enable comprehensive audit logging for all asset deletion operations, and conduct a complete access control review to ensure proper Parameter Context isolation. Within 30 days, monitor for vendor patches and develop a tested upgrade strategy for affected versions (2.0.0-2.10.0); implement additional interim controls including mandatory approval workflows for asset deletions and real-time alerting on suspicious deletion attempts.

Apache NiFi CVE-2026-68980

Q: What is the CVSS score of CVE-2026-68980?

CVE-2026-68980 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Clear. EPSS exploitation probability: 0.3%.

EUVD-2026-52421 LOW

Incorrect Authorization (CWE-863)

2026-08-03

GHSA-xq5v-6pm7-4qw9

Apache Authentication Bypass Nifi

2.3

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Clear

vuln.today AI

5.4 MEDIUM

Network-reachable REST API requires low privilege (write to any one context); deletion-only impact means no confidentiality loss, modest integrity and availability degradation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Aug 03, 2026 - 20:22 NVD

2.3 (LOW)

Analysis Generated

Aug 03, 2026 - 20:17 vuln.today

CVE Published

Aug 03, 2026 - 19:56 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Authorization bypass in Apache NiFi 2.0.0-2.10.0 allows authenticated users holding write access to one Parameter Context to delete Assets belonging to a separate, restricted Parameter Context they are not authorized to modify. The REST API's asset deletion endpoint validated permissions against the caller-supplied Parameter Context Identifier without confirming that the targeted Asset Identifier is actually recorded as belonging to that context - a broken object-level authorization (BOLA/IDOR) flaw. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; impact is confined to multi-tenant NiFi deployments with differentiated per-context authorization policies.

Technical ContextAI

Apache NiFi (org.apache.nifi:nifi-web-api) is an enterprise data-flow automation platform that groups configuration values into Parameter Contexts, each of which can own named Assets accessible through the REST API. The authorization framework constructs a composite ownership key from both the Parameter Context ID and the Asset ID, then enforces write permissions at the Parameter Context boundary. In versions 2.0.0-2.10.0, the DELETE asset endpoint verified only whether the caller holds write access to the Parameter Context Identifier they supplied in the request, without cross-referencing that the submitted Asset Identifier is recorded as belonging to that context in persistent storage. This is a CWE-863 (Incorrect Authorization) pattern - the server trusts a caller-controlled foreign-key value rather than resolving the asset's authoritative parent. Jira NIFI-16154 confirms the fix aligns delete behavior with the existing read path, which already performed the ownership verification correctly.

RemediationAI

Upgrade to Apache NiFi 2.11.0, the vendor-confirmed fix version documented in Jira NIFI-16154 (resolved via GitHub Pull Request #11485). The patch aligns the asset delete authorization check with the existing read-path check, verifying Parameter Context ownership of the requested Asset before deletion is permitted. For organizations unable to upgrade immediately, the most effective compensating control is to grant uniform write permissions across all Parameter Contexts to all NiFi users, which eliminates the authorization boundary the vulnerability exploits - though this trades the security isolation for operational exposure to over-privileged users, so it should be treated as a short-term measure only. As an additional layer, restrict network access to the NiFi REST API to trusted internal networks or VPN-only segments to reduce the pool of potential authenticated attackers. Advisory references: https://nifi.apache.org/ and https://seclists.org/oss-sec/2026/q3/398.