Apache NiFi CVE-2026-68980

Exploitation requires an active authenticated session in Apache NiFi with write-level (WRITE permission) access to at least one Parameter Context. Critically, the target NiFi installation must be configured with differentiated authorization policies across Parameter Contexts - some contexts must be accessible to the attacker while others carry restricted access. Apache NiFi explicitly confirms that installations without distinct authorization levels across Parameter Contexts are not subject to this vulnerability, because uniform write permissions remove the exploitable boundary. Additionally, the attacker must know or enumerate a valid Asset Identifier belonging to a restricted Parameter Context; since the read endpoint correctly verifies ownership, the attacker cannot use the API to list assets in contexts they cannot access, which raises the practical difficulty. Exploitation is strictly limited to asset deletion and does not enable data exfiltration or code execution.

Real-world risk is substantially limited by multiple concurrent prerequisites. Exploitation requires an active authenticated session with write-level permissions to at least one Parameter Context, ruling out unauthenticated attacks. More critically, the Apache NiFi project explicitly states that installations without differentiated authorization policies across Parameter Contexts are entirely unexposed - the vulnerability only manifests in deliberately configured multi-tenant deployments, which are non-default. The blast radius is further constrained to asset deletion: there is no confidentiality impact and no path to code execution; availability impact is indirect, manifesting only if dependent data flows break after an asset is removed. No NVD CVSS vector has been published at time of analysis - the reporter categorizes severity as Low, which is consistent with the narrow exploitation conditions. No EPSS score is available. The vulnerability carries no CISA KEV listing and no public proof-of-concept code has been identified, indicating this is a theoretical risk rather than one being actively abused.

An authenticated NiFi user with write access to Parameter Context A, but explicitly denied access to Parameter Context B, crafts a DELETE REST API request specifying their own authorized Context A identifier alongside an Asset identifier that belongs to Context B. The server confirms write permission against Context A and proceeds with deletion without verifying the asset's stored parent, permanently removing the asset from Context B. No public proof-of-concept code has been identified for this vulnerability.