Apache NiFi Vulnerabilities Allow Authorization Bypass and DoS
Four vulnerabilities in Apache NiFi versions 1.5.0 through 2.10.0 could allow attackers to bypass authorization, alter configurations, and cause denial-of-service conditions.
Apache NiFi users are urged to upgrade to version 2.11.0 following the disclosure of four security vulnerabilities that impact the NiFi Web API and its Parameter Context authorization controls. These flaws, affecting versions 1.5.0 through 2.10.0, could lead to authorization bypass, unauthorized configuration changes, validation abuse, memory exhaustion, and in certain deployments, code execution through manipulated parameter values.
The most severe issues revolve around Parameter Contexts, which are used to store reusable configuration values for NiFi processors and related components. CVE-2026-62354 (NIFI-16112), rated High, impacts versions 1.10.0 through 2.10.0. It allowed users with read-only access to a Parameter Context to submit validation requests with proposed parameter values that could override current settings during the validation process. Apache NiFi 2.11.0 now requires write permission to submit Parameter Context validation requests, mitigating this risk.
Another significant vulnerability, CVE-2026-68979 (NIFI-16148), a Medium-severity authorization flaw affecting versions 1.10.0 through 2.10.0, allowed authenticated users with permission to change a Parameter Context to update values that impacted components they were not authorized to manage. In deployments where parameters contain executable script content, this could lead to code execution during the automatic validation of stopped components. Version 2.11.0 introduces authorization checks for all affected components when a Parameter Context is updated.
A Low-severity issue, CVE-2026-68980 (NIFI-16154), affects versions 2.0.0 through 2.10.0. This vulnerability in the REST API allowed Asset deletion using a supplied Parameter Context identifier without verifying if the Asset belonged to that specific context. This could enable a user to delete an Asset associated with a different Parameter Context, particularly in environments with differentiated authorization levels. The fix in Apache NiFi 2.11.0 ensures ownership is confirmed before deletion.
The highest severity vulnerability, CVE-2026-68981 (NIFI-16152), rated High and affecting versions 1.5.0 through 2.10.0, involves memory exhaustion via crafted gzip requests. NiFi accepted gzip-encoded REST API requests but enforced the maximum request size on the compressed payload instead of the decompressed data. Attackers could send a small compressed request that decompressed into a significantly larger payload, consuming excessive memory and potentially leading to a denial-of-service condition. Apache NiFi 2.11.0 addresses this by moving response compression to the Jetty Server and disabling decompression of gzip-encoded HTTP requests.
Organizations utilizing Apache NiFi should prioritize upgrading to version 2.11.0 to protect against these vulnerabilities. It is also recommended to review Parameter Context and component-level authorization policies, especially in environments where parameters might contain executable scripts that could be triggered during automatic validation of stopped components.
The vulnerabilities were reported by security researchers mak3bread (Minseong Kim), Nguyen Van Hiep from MBBank, and D0HY30N.