CVE-2026-62354 Overview
CVE-2026-62354 is an authorization handling flaw in Apache NiFi versions 1.10.0 through 2.10.0. The vulnerability affects Parameter Context validation requests, allowing clients with read-only access to submit proposed Parameter values. These proposed values override the current configuration during validation, letting low-privileged users invoke predefined component validation methods with attacker-chosen settings. The issue maps to CWE-863: Incorrect Authorization. Installations that enforce identical authorization for viewing and modifying Parameter Contexts are not affected. Apache NiFi 2.11.0 fixes the flaw by requiring write access for Parameter Context validation requests.
Critical Impact
Users with only read access can influence Parameter Context validation, causing components to run validation logic with alternative parameter values not authorized for that user.
Affected Products
- Apache NiFi 1.10.0 through 1.x latest
- Apache NiFi 2.0.0 through 2.10.0
- Apache NiFi deployments with differentiated read/write authorization for Parameter Contexts
Discovery Timeline
- 2026-08-03 - CVE-2026-62354 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-62354
Vulnerability Analysis
Apache NiFi uses Parameter Contexts to manage configuration values referenced by flow components. Parameter Context validation endpoints let clients submit proposed Parameter values and receive validation feedback from affected components. In versions 1.10.0 through 2.10.0, this endpoint enforces read-level authorization only. Clients possessing read access can therefore submit proposed values that override the stored Parameter Context configuration during validation.
The validation path invokes component-defined logic against the submitted values. An attacker with read privileges can exercise these predefined validation methods using inputs they would not otherwise be authorized to configure. This weakens the boundary between viewing configuration and modifying its runtime evaluation context.
Root Cause
The root cause is missing write-level authorization on the Parameter Context validation request handler. The endpoint treated proposed value submission as a read-adjacent operation. Because proposed values override current configuration for the duration of validation, the operation is functionally a modification and should require write authorization on the Parameter Context resource.
Attack Vector
The attack is network-based and requires authenticated access with read permission on a Parameter Context. The attacker submits a validation request containing crafted Parameter values. NiFi accepts the request, applies the proposed values, and runs the associated component validation methods. The impact scales with what those validation methods do when invoked with attacker-controlled inputs across the environment.
No verified public proof-of-concept is available. Technical detail is published on the Apache Mailing List Thread and the OpenWall OSS Security Post.
Detection Methods for CVE-2026-62354
Indicators of Compromise
- HTTP requests to Parameter Context validation endpoints (/nifi-api/parameter-contexts/{id}/validation-requests) originating from accounts holding only read privileges.
- Repeated validation requests from a single principal containing varying proposed Parameter values.
- Audit log entries showing validation activity that does not correlate with subsequent authorized Parameter Context updates.
Detection Strategies
- Correlate NiFi audit logs with the effective policy set to identify validation requests submitted by principals without write access on the targeted Parameter Context.
- Enable verbose logging on Parameter Context REST endpoints and alert on validation submissions that include proposed value payloads.
- Baseline normal Parameter Context validation traffic per user and flag deviations in volume or timing.
Monitoring Recommendations
- Ingest NiFi audit and application logs into a centralized analytics platform and retain them for post-incident review.
- Monitor authentication and authorization events for NiFi service accounts and administrative users.
- Alert on any use of Parameter Context APIs outside change-management windows.
How to Mitigate CVE-2026-62354
Immediate Actions Required
- Upgrade Apache NiFi to version 2.11.0, which enforces write authorization on Parameter Context validation requests.
- Review Parameter Context policies and identify accounts holding read-only access that could exercise the vulnerable endpoint.
- Audit recent validation request activity for suspicious submissions from low-privileged users.
Patch Information
The Apache NiFi project addressed CVE-2026-62354 in version 2.11.0. The fix requires write access on the Parameter Context resource before validation requests containing proposed values are accepted. Refer to the Apache Mailing List Thread for the official advisory.
Workarounds
- Align read and write authorization on Parameter Contexts so that only trusted users hold either right, which removes the privilege gap the vulnerability abuses.
- Restrict network access to the NiFi REST API using firewall rules or a reverse proxy that enforces stronger authentication on validation endpoints.
- Temporarily remove read access to sensitive Parameter Contexts from accounts that do not require it until the upgrade is complete.
# Verify installed Apache NiFi version and plan upgrade to 2.11.0
cat $NIFI_HOME/NOTICE | head -5
$NIFI_HOME/bin/nifi.sh status
# After upgrade, confirm the running version
curl -k https://<nifi-host>:8443/nifi-api/system-diagnostics | jq '.systemDiagnostics.versionInfo'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
