CVE-2026-68979

Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.10.0 through 2.10.0

Description A Parameter Context update REST API method fails to enforce authorization checks on components that reference parameter values. While framework authorization was limited to read and write privileges on the Parameter Context itself, an authenticated user with permission to modify a Parameter Context could alter values affecting components they are not authorized to access. In environments where parameter values contain executable scripting content, this could lead to code execution during automatic component validation, even if the referencing component is not started. This issue specifically affects deployments using component-level authorization policies and is limited to stopped components.

Recommendations Update to version 2.11.0.