Auth bypass in Apache Software Foundation Nifi
CVE-2026-68980
Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parame…
Vulnerability class: Broken Access Control
Affected products
- Apache Software Foundation Nifi — versions 2.0.0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory)
- af854a3a-2127-422b-91ae-364da2661108