CVE-2026-68980 is an authorization flaw in Apache NiFi 2.0.0 through 2.10.0. The REST API checked permission against the supplied Parameter Context ID without confirming the asset belonged to it. NVD scores it 9.1 while the project rates it Low. Upgrade to NiFi 2.11.0.
What's affected
- Product: Apache NiFi, nifi-web-api.
- Affected versions: 2.0.0 through 2.10.0.
- Fixed version: 2.11.0, which verifies that the parameter context owns the requested asset before deleting it.
- Weakness: CWE-863 incorrect authorization.
- Scope limit from the project: installations that do not use different authorization levels across parameter contexts are not subject to this issue.
- Severity: NVD lists CVSS 9.1. The Apache announcement says Low.
How to check if you're exposed
Check the NiFi version on each instance. In the UI, open the help menu and About, or look at the library names on disk:
ls /opt/nifi/lib | grep nifi-web-api
Then ask whether you split authorization across parameter contexts. If different teams own different contexts with different write permissions, the check matters. If one group manages all of them, the issue has little effect.
What to do now
- Check the NiFi version on every instance.
- Upgrade to NiFi 2.11.0 or later.
- Review who has write permission on each parameter context.
- Check recent asset deletions against expected changes.
- Keep this alongside CVE-2026-68979 in your NiFi upgrade, since both are fixed in 2.11.0.
Why it matters
Authorization checks need to bind to the thing being changed. Here the framework checked the right to write to a parameter context named in the request, but it did not confirm that the asset named in the same request belonged to that context. A user with write rights to one context could point at an asset in another. Read operations already verified ownership, and the fix applies the same method to deletion.
The effect is limited to deletion, and only where contexts are split between teams, which is why the project rates it Low even though the NVD score is high. It is a common bug class: a request carries two identifiers and the code checks one. The CISA KEV flag is false and no exploitation is reported.
Quick check
Does this let someone read or change assets?
The announcement describes deletion. It says read operations already used the ownership check.
Why do the ratings differ?
NVD scores the vector, and the project rates the real conditions, which require a split authorization setup.
Sources
Last reviewed: 19 October 2026.
