Listen to this Post
How CVE-2026-68980 Works
Apache NiFi versions 2.0.0 through 2.10.0 expose REST API endpoints for creating, reading, and deleting Assets associated with Parameter Contexts. The framework’s authorization logic for asset deletion contains a critical flaw: it performs the authorization check against the Parameter Context using the supplied Parameter Context Identifier and Asset Identifier, but fails to verify that the supplied Asset Identifier actually belongs to the supplied Parameter Context.
In practice, this means an authenticated user with delete permissions on Parameter Context A could send a deletion request for an Asset that belongs to Parameter Context B, by simply supplying Context A’s identifier in the request along with the target Asset’s identifier. The framework would authorize the action against Context A (which the user has rights to) and delete the asset from Context B without ever checking ownership.
This bypass is only exploitable in environments where different levels of authorization are implemented across Parameter Contexts. If all Parameter Contexts share the same authorization level, the framework’s write permission enforcement acts as the security boundary, rendering the vulnerability unexploitable.
The vulnerability was discovered by mak3bread (Minseong Kim) and reported on July 27, 2026. It is tracked under Apache Jira issue NIFI-16154. The Apache NiFi team addressed the issue in version 2.11.0 by implementing ownership verification for the requested Asset before deletion, using the same strategy already applied to Asset read operations. The fix ensures that the deletion authorization logic now validates that the Asset Identifier belongs to the Parameter Context Identifier supplied in the request.
DailyCVE Form:
Platform: Apache NiFi
Version: 2.0.0–2.10.0
Vulnerability: Authorization Bypass
Severity: Low
date: August 3, 2026
Prediction: July 27, 2026
What Undercode Say:
Analytics:
- CVE assigned: August 1, 2026
- Public disclosure: August 3, 2026
- EPSS Base Score: 0.26 (low probability of exploitation)
- CVSS v3 Base Score: 6.3 (Medium) — Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- CVSS v4 Base Score: 2.3 (Low) — Attack Complexity: LOW, Attack Requirements: PRESENT, Privileges Required: LOW
- Exploit price estimate: $0–$5k USD
- Affected package: `org.apache.nifi:nifi-web-api` (Java)
- Fixed version: `2.11.0`
Bash Commands & Codes:
Check current Apache NiFi version ./bin/nifi.sh status Upgrade to patched version (2.11.0) wget https://downloads.apache.org/nifi/2.11.0/nifi-2.11.0-bin.tar.gz tar -xzf nifi-2.11.0-bin.tar.gz ./nifi-2.11.0/bin/nifi.sh start Verify upgrade ./nifi-2.11.0/bin/nifi.sh status | grep Version For Docker deployments docker pull apache/nifi:2.11.0 docker run -d -p 8443:8443 --name nifi apache/nifi:2.11.0
Exploit:
- Prerequisites: Authenticated user with delete permissions on at least one Parameter Context.
- Attack Vector: Remote, over the network.
- Attack Complexity: Low.
- Required Privileges: Low.
- User Interaction: None.
- Exploit Availability: None publicly available as of August 2026.
- Technique (MITRE ATT&CK): T1548.002 — Abuse Elevation Control Mechanism.
Protection:
- Primary Mitigation: Upgrade to Apache NiFi 2.11.0 or later.
- Workaround: If upgrading is not immediately possible, ensure that all Parameter Contexts have identical authorization levels across the deployment. In such configurations, the framework’s write permission enforcement acts as the security boundary and prevents exploitation.
- Monitoring: Audit REST API logs for suspicious asset deletion requests where the supplied Parameter Context Identifier does not match the asset’s actual owning context.
- Network Controls: Restrict access to the NiFi REST API to trusted networks and users only.
Impact:
- Confidentiality: Low impact — an attacker could potentially delete assets they should not have access to, but cannot read or modify them.
- Integrity: Low impact — unauthorized deletion of Parameter Context Assets could disrupt data flows that depend on those assets.
- Availability: Low impact — deletion of critical assets could cause flow failures or misconfigurations.
- Scope: Unchanged — the vulnerability does not extend beyond the affected component.
- Risk Context: Only environments with differentiated authorization levels across Parameter Contexts are vulnerable. Homogeneous authorization setups are not affected.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
