CVE-2026-68979 Overview
CVE-2026-68979 is a missing authorization vulnerability [CWE-862] affecting Apache NiFi versions 1.10.0 through 2.10.0. The Parameter Context update REST API method fails to enforce authorization checks on components that reference Parameter values. Framework authorization is limited to read and write privileges on the Parameter Context itself, ignoring the referencing components.
An authenticated user with permission to modify a Parameter Context, but without authorization on referencing components, can alter Parameter values affecting those components. When a Parameter value contains executable scripting content, updating it can trigger code execution during automatic component validation.
Critical Impact
Authenticated users with limited privileges can bypass component-level authorization to modify parameter values, potentially triggering code execution during component validation in deployments using component-level authorization policies.
Affected Products
- Apache NiFi 1.10.0 through 1.x (all versions in the 1.x line from 1.10.0 onward)
- Apache NiFi 2.0.0 through 2.10.0
- Deployments using component-level authorization policies
Discovery Timeline
- 2026-08-03 - CVE-2026-68979 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-68979
Vulnerability Analysis
Apache NiFi provides Parameter Contexts as reusable containers for parameter values that referencing components can consume during flow execution. The Parameter Context update REST API method enforces authorization only against the Parameter Context resource. It does not evaluate authorization policies on the downstream components that reference those parameters.
This authorization gap allows an authenticated user with write access on a Parameter Context, but no permissions on referencing processors or controller services, to change parameter values used by those components. Existing verification checks limit impact to stopped components, but automatic component validation runs when parameters change. Where a parameter value contains executable scripting content, that validation path can execute the supplied code without the referencing component being started by the attacker.
Root Cause
The root cause is inconsistent authorization enforcement across REST API methods that mutate Parameter Contexts. The update method checks only Parameter Context read and write privileges. Other methods correctly evaluate authorization on affected components, creating an asymmetry the fix in 2.11.0 resolves.
Attack Vector
Exploitation requires an authenticated account with write access to a Parameter Context in a deployment that uses component-level authorization policies. The attacker sends a Parameter Context update request via the REST API, replacing a parameter value with a payload containing scripting content. Automatic validation on referencing components processes the new value and executes the embedded script. The vulnerability is exploitable over the network as documented in the CVSS vector.
No verified proof-of-concept code has been published. Refer to the Apache Security Discussion Thread and the Openwall OSS Security Post for the vendor description.
Detection Methods for CVE-2026-68979
Indicators of Compromise
- Unexpected PUT or POST requests to /nifi-api/parameter-contexts/{id} endpoints from accounts without permission on referencing components
- Parameter values containing shell commands, Groovy, Jython, or other scripting content in audit logs
- Component validation events immediately following Parameter Context updates by lower-privileged users
- New or unexpected child processes spawned by NiFi service accounts during validation windows
Detection Strategies
- Audit NiFi flow provenance and user action history for Parameter Context modifications correlated with subsequent validation errors or process spawns
- Compare Parameter Context modification events against the authorization policies of components referencing those parameters to surface privilege mismatches
- Alert on parameter values that contain scripting keywords such as Runtime.exec, ProcessBuilder, bash -c, or powershell
Monitoring Recommendations
- Enable NiFi audit logging and forward events to a centralized SIEM for correlation with authentication and process telemetry
- Monitor the NiFi host operating system for child processes originating from the NiFi JVM outside expected flow execution windows
- Track REST API activity against /nifi-api/parameter-contexts for anomalous update frequency or off-hours changes
How to Mitigate CVE-2026-68979
Immediate Actions Required
- Upgrade Apache NiFi to version 2.11.0, which aligns Parameter Context update authorization with other mutation methods
- Inventory user and group assignments with write access to Parameter Contexts and validate whether those principals should also have access to referencing components
- Review existing Parameter Context values for scripting content that could be abused post-exploitation
- Restrict Parameter Context write privileges to trusted administrators until the upgrade is complete
Patch Information
The Apache NiFi project fixed CVE-2026-68979 in version 2.11.0. The patch adds authorization checking on components affected by Parameter Context updates, matching the enforcement model used by other Parameter Context REST methods. Consult the Apache Security Discussion Thread for release details.
Workarounds
- Remove Parameter Context write permissions from users who lack authorization on referencing components until upgrading
- Avoid storing executable scripting content inside Parameter values; move script logic into version-controlled processor configurations
- Segment NiFi deployments so that sensitive components reside in Parameter Contexts managed only by fully authorized administrators
- Place NiFi REST API endpoints behind network controls that restrict access to trusted operator networks
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
