Apache NiFi Critical Vulnerabilities Enable Authorization Bypass

Key Takeaways

• Apache NiFi has addressed four security vulnerabilities impacting its Web API and Parameter Context authorization.
• The flaws could lead to authorization bypass, unauthorized configuration changes, denial-of-service, and, in specific configurations, remote code execution.
• Affected NiFi versions range from 1.5.0 through 2.10.0, depending on the specific vulnerability.
• Users are strongly advised to upgrade to Apache NiFi version 2.11.0 to mitigate these risks.

The Apache Software Foundation has released an urgent advisory for users of its NiFi data flow system, detailing four critical security vulnerabilities. These flaws, which impact various aspects of the NiFi Web API and Parameter Context authorization mechanisms, could allow malicious actors to bypass security controls, modify configurations without proper authorization, and even execute arbitrary code in certain scenarios. Organizations leveraging Apache NiFi are strongly urged to update their installations to version 2.11.0 to address these significant security risks.

The identified vulnerabilities span Apache NiFi versions 1.5.0 through 2.10.0. The most severe of these issues are associated with NiFi’s Parameter Contexts, which are integral for storing and managing reusable configuration values across different processors and components within the data flow architecture.

Apache NiFi Vulnerabilities Detailed

High-Severity Parameter Context Validation Bypass

Tracked as NIFI-16112 and assigned CVE-2026-62354, this high-severity vulnerability affects Apache NiFi versions 1.10.0 through 2.10.0. The flaw permitted users possessing read-only access to a Parameter Context to submit validation requests containing proposed Parameter values. Crucially, these proposed values could temporarily override existing configuration settings during the validation process.

This design oversight meant that a user with merely read permissions could trigger predefined component validation methods using alternative, potentially malicious, settings. The vulnerability poses a particular threat in environments where distinct read and write permissions are enforced for Parameter Contexts. Apache NiFi 2.11.0 now mandates explicit write permission for all Parameter Context validation requests, closing this bypass vector. The issue was reported by Nguyen Van Hiep from MBBank.

Medium-Severity Authorization Bypass Leading to Potential Code Execution

Designated CVE-2026-68979 and internally identified as NIFI-16148, this medium-severity authorization flaw impacts versions 1.10.0 through 2.10.0. The core issue stemmed from NiFi’s failure to adequately verify authorization for components that referenced values from a Parameter Context that had been modified.

Consequently, an authenticated user with permission to alter a Parameter Context could update values that subsequently affected components they were not authorized to manage. In scenarios where a Parameter contained executable script content, such a change could even lead to arbitrary code execution during the automatic validation of a stopped component. Apache notes that existing verification controls limit the immediate risk to stopped components and require specific component-level authorization policies for exploitation. Apache NiFi 2.11.0 introduces comprehensive authorization checks for all affected components whenever a Parameter Context undergoes an update. This vulnerability was discovered by D0HY30N.

Low-Severity Asset Deletion Authorization Issue

A low-severity authorization vulnerability, CVE-2026-68980 (NIFI-16154), affects Apache NiFi versions 2.0.0 through 2.10.0. This flaw concerned the REST API’s process for authorizing Asset deletion. While the API used a supplied Parameter Context identifier for authorization, it failed to verify if the Asset actually belonged to that specific Parameter Context.

This oversight could allow a user to delete an Asset associated with a different Parameter Context in deployments employing varied authorization levels. Apache NiFi 2.11.0 now includes a crucial check to confirm Asset ownership before permitting deletion, thus preventing unauthorized removals. This issue was reported by mak3bread (Minseong Kim).

High-Severity Denial of Service via Gzip Decompression

Rated as high severity, CVE-2026-68981 (NIFI-16152) impacts Apache NiFi versions 1.5.0 through 2.10.0. NiFi’s REST API accepted gzip-encoded requests but incorrectly enforced the maximum request size limit on the compressed payload rather than the decompressed data. This allowed for a critical vulnerability.

An attacker could craft a small, gzip-compressed request that would expand significantly upon decompression, leading to excessive memory consumption within the NiFi instance. This could ultimately trigger a denial-of-service condition, rendering the system unavailable. Apache NiFi 2.11.0 addresses this by moving response compression handling to the Jetty Server and disabling the decompression of gzip-encoded HTTP requests within NiFi itself. This vulnerability was identified by mak3bread (Minseong Kim).

What You Should Do

• Immediately upgrade all Apache NiFi deployments to version 2.11.0.
• Review and strengthen existing Parameter Context and component-level authorization policies to ensure least privilege principles are rigorously applied.
• Scrutinize Parameter values, especially those that contain executable scripts, and assess potential risks, particularly in scenarios where stopped components are subject to automatic validation.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.