Auth bypass in Apache Software Foundation Nifi
CVE-2026-68979
Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that aff…
Vulnerability class: Broken Access Control
Affected products
- Apache Software Foundation Nifi — versions 1.10.0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory)
- af854a3a-2127-422b-91ae-364da2661108