CVE-2026-68979 is a missing authorization flaw in Apache NiFi 1.10.0 through 2.10.0. A user allowed to edit a Parameter Context, but not the components that use it, could change values that affect those components. NVD scores it 9.8, while the project rates it Medium. Upgrade to NiFi 2.11.0.
What's affected
- Product: Apache NiFi, nifi-web-api.
- Affected versions: 1.10.0 through 2.10.0.
- Fixed version: 2.11.0, which adds authorization checks on the components that reference a parameter context.
- Weakness: CWE-862 missing authorization.
- Scope limit from the project: the issue applies only to deployments that use component level authorization policies.
- Severity: NVD lists CVSS 9.8. The Apache announcement gives the severity as Medium, so the two differ. The project's text describes the real conditions, which are an authenticated user and a specific policy setup.
How to check if you're exposed
Check the NiFi version in the UI under the help menu, then About, or on disk:
ls /opt/nifi/lib | grep nifi-web-api
Then check whether you use component level authorization. In NiFi's access policies, see whether different users or groups have different rights on individual processors, process groups or controller services, and who holds the right to modify parameter contexts. If everyone with edit access to parameter contexts also has the same rights on the components, the exposure is limited.
What to do now
- Check the NiFi version on every instance, including development clusters.
- Upgrade to NiFi 2.11.0 or later.
- Review who can modify parameter contexts and give that right only to people who also may change the referencing components.
- Check for parameters whose values contain scripts, and review recent parameter changes.
- Re-run your access policy review after the upgrade.
Why it matters
NiFi lets operators define parameters once and use them in many components. The problem is a gap in permission checks. Updating a parameter context needed read and write rights on the context itself, but not on the components that use its values. Changing a value can change what those components do. In a deployment where a parameter value holds executable scripting content, the announcement says updating the parameter can lead to code execution during automatic component validation, without starting the component. Existing checks limit the impact to stopped components.
The gap only matters if you have split permissions between contexts and components. In a simple deployment with one trusted admin group it changes little. The CISA KEV flag is false and no exploitation is reported.
Try it yourself
This walkthrough shows how a vulnerability that depends on your own configuration can be tracked with context and closed.
Click through it at your own pace, or open it full screen.
Quick check
Why is the score 9.8 when the project says Medium?
The NVD vector assumes no privileges and the worst impact. The project text says an authenticated user and component level policies are needed. Read both before ranking the work.
What is the fix?
Upgrade to NiFi 2.11.0, which aligns authorization on this method with other methods.
Sources
Last reviewed: 19 October 2026.
