CVE-2026-68980
criticalpriority · track · 36OT risk · elevatedEPSS 0.005 · 41 %ileDEEUUSEPSS · scored 2026-10-27
Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework performed authorized based on the supplied Parameter Context Identifier without verifying the requested Identifier against the stored Identifier. Apache NiFi installations that do not implement different levels of authorization across Parameter Contexts are not subject to this vulnerability, because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which verifies Parameter Context ownership of the requested Asset before deletion using the same strategy applied to Asset read operations.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–critical · 0.6–9.1
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (5)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-2639Apache Nifi: Mehrere SchwachstellenDeutsch2026-08-03csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Apache Nifi ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen oder möglicherweise beliebigen Code auszuführen.
- BIT-nifi-2026-68980Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion2026-08-17vendor · osvUS
Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework performed authorized based on the supplied Parameter Context Identifier without verifying the requested Identifier against the stored Identifier. Apache NiFi installations that do not implement different levels of authorization across Parameter Contexts are not subject to this vulnerability, because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which verifies Parameter Context ownership of the requested Asset before deletion using the same strategy applied to Asset read operations.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2026/08/03/12cnnvd
- https://lists.apache.org/thread/yo8k6tt3zxjm49zzhly3453v0xhwm3o1cnnvd
- https://lists.apache.org/thread/yo8k6tt3zxjm49zzhly3453v0xhwm3o1enisa_euvd
- http://www.openwall.com/lists/oss-security/2026/08/03/12Mailing ListThird Party Advisorynvd
- https://lists.apache.org/thread/yo8k6tt3zxjm49zzhly3453v0xhwm3o1Mailing ListVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan