CVE-2026-68980: Apache NiFi Auth Bypass Vulnerability

CVE-2026-68980 Overview

CVE-2026-68980 is an authorization flaw [CWE-863] affecting Apache NiFi versions 2.0.0 through 2.10.0. The framework exposes REST API endpoints for creating, reading, and deleting Assets associated with Parameter Contexts. When processing asset deletion requests, the framework authorized the action using only the supplied Parameter Context Identifier without verifying it against the stored Identifier for the Asset. An authenticated user with write access to one Parameter Context can therefore delete Assets belonging to another Parameter Context.

Critical Impact
Authenticated users with write permissions on a Parameter Context can delete Assets stored under other Parameter Contexts, bypassing the intended per-context authorization boundary.

Affected Products

Apache NiFi 2.0.0
Apache NiFi 2.x releases up to and including 2.10.0
Apache NiFi deployments that implement differentiated authorization across Parameter Contexts

Discovery Timeline

2026-08-03 - CVE-2026-68980 published to the National Vulnerability Database (NVD)
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-68980

Vulnerability Analysis

Apache NiFi manages configuration values through Parameter Contexts, which can own Assets referenced by processors and controller services. The REST API supports create, read, and delete operations on these Assets. Each request supplies both a Parameter Context Identifier and an Asset Identifier.

For deletion, the framework enforced authorization by checking write permissions against the Parameter Context Identifier submitted in the request. It did not confirm that the requested Asset Identifier actually belonged to that Parameter Context. An attacker with write access on any Parameter Context could pass its Identifier alongside an Asset Identifier owned by a different Parameter Context. The framework granted the deletion because the authorization check evaluated the attacker-supplied context, not the storage relationship.

Read operations already validated Parameter Context ownership before returning an Asset. The delete path did not apply the same validation, producing an inconsistent enforcement model.

Root Cause

The root cause is improper authorization [CWE-863]. The framework trusts the client-supplied Parameter Context Identifier as the subject of the permission check instead of resolving the Asset's stored owning context and authorizing against that value. Installations that do not segment authorization across Parameter Contexts are unaffected because write permission functions as the security boundary.

Attack Vector

Exploitation requires network access to the NiFi REST API and valid credentials with write permission on at least one Parameter Context. The attacker issues a delete request that pairs their authorized Parameter Context Identifier with an Asset Identifier owned by a different, protected Parameter Context. See the Apache Mailing List Thread and the Openwall OSS-Security Update for advisory details.

No verified public exploit code is available for CVE-2026-68980. The vulnerability mechanism is described in the vendor advisory referenced above.

Detection Methods for CVE-2026-68980

Indicators of Compromise

HTTP DELETE requests to Parameter Context Asset endpoints where the Parameter Context Identifier in the URL path does not correspond to the owning context of the referenced Asset Identifier.
Unexpected removal of Assets from Parameter Contexts that the requesting user is not authorized to modify.
Audit log entries showing asset deletion by principals that lack write permissions on the affected Parameter Context.

Detection Strategies

Review NiFi audit and provenance logs for asset deletion events and correlate the acting user against the authorization policy of the owning Parameter Context.
Compare pre- and post-request asset inventories across Parameter Contexts to identify deletions crossing context boundaries.
Alert on REST API DELETE calls to /nifi-api/parameter-contexts/{id}/assets/{assetId} where {id} and {assetId} do not match a legitimate ownership pairing.

Monitoring Recommendations

Forward NiFi access, user, and provenance logs to a centralized logging platform for correlation and long-term retention.
Track baseline delete rates for Parameter Context Assets and alert on deviations by user, context, or time window.
Monitor administrative changes to Parameter Context authorization policies that may broaden the population of users with write access.

How to Mitigate CVE-2026-68980

Immediate Actions Required

Upgrade Apache NiFi to version 2.11.0, which validates Parameter Context ownership of the requested Asset before deletion.
Inventory all Parameter Contexts and review which principals hold write permissions across contexts.
Audit recent asset deletion events to confirm no cross-context deletions occurred prior to patching.

Patch Information

Apache NiFi 2.11.0 remediates CVE-2026-68980 by applying the same ownership verification used for Asset read operations to Asset delete operations. Refer to the Apache Mailing List Thread for the official advisory and release notes.

Workarounds

Restrict write permissions on Parameter Contexts to a minimal set of trusted administrators until the upgrade is applied.
Consolidate Parameter Contexts under uniform authorization where differentiated access is not required, which removes the security boundary the flaw crosses.
Place the NiFi REST API behind network controls that limit access to authenticated administrative sources only.

bash

# Verify the running Apache NiFi version and confirm the fixed release
curl -s -u "$NIFI_USER:$NIFI_PASS" \
  https://nifi.example.com/nifi-api/system-diagnostics \
  | jq '.systemDiagnostics.aggregateSnapshot.versionInfo.niFiVersion'

# Expected output after remediation: "2.11.0" or later