Auth bypass in Apache Software Foundation Nifi
CVE-2026-62354
Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users w…
Vulnerability class: Broken Access Control
Affected products
- Apache Software Foundation Nifi — versions 1.10.0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory)
- af854a3a-2127-422b-91ae-364da2661108