Listen to this Post
Apache NiFi versions 1.10.0 through 2.10.0 expose a Parameter Context update REST API endpoint (/nifi-api/parameter-contexts/{id}) that fails to enforce proper authorization checks on components referencing the updated Parameter values. The framework’s authorization logic only verified that the authenticated user had read and write privileges on the Parameter Context object itself, but did not verify whether the same user was authorized to modify the downstream components that actually consume those parameters.
This design flaw allows an authenticated attacker who has permission to modify a Parameter Context—but lacks explicit authorization on the components that reference it—to alter parameter values that those components depend on. In environments where parameter values embed executable scripting content (e.g., Groovy, Python, or shell commands within `ExecuteScript` or `InvokeScriptedProcessor` processors), changing a parameter can trigger automatic component validation routines that execute the newly injected script. This execution occurs without requiring the referencing component to be started, meaning the code runs during the validation phase itself.
The vulnerability is limited to stopped components because existing verification checks prevent execution on running processors. Additionally, the issue only manifests in deployments that use component‑level authorization policies—environments that rely solely on global or process‑level permissions are not affected. The attack vector is network‑based, requires low attack complexity, and demands high privileges (authenticated user with Parameter Context write access). The CVSS v3 base score is 8.2 (High) with a CHANGED scope, while CVSS v4 rates it at 5.9 (Medium). The vulnerability was reported on 2026‑07‑22 and publicly disclosed on 2026‑08‑03. Apache has addressed the issue in version 2.11.0 by aligning the Parameter Context update method with other REST endpoints, adding mandatory authorization checks on all affected referencing components.
DailyCVE Form:
Platform: Apache NiFi
Version: 1.10.0-2.10.0
Vulnerability: Missing Authorization (CWE-862)
Severity: Medium (CVSS 8.2)
date: 2026-08-03
Prediction: 2026-08-10 (patch expected)
What Undercode Say:
- Analytics:
- CVSS v3 Base Score: 8.2 (High) – Attack Vector: NETWORK, Attack Complexity: LOW, Privileges Required: HIGH, Scope: CHANGED, Confidentiality: LOW, Integrity: HIGH, Availability: LOW
- CVSS v4 Base Score: 5.9 (Medium)
- EPSS Base Score: 0.35 (≈35% exploitation probability)
- Affected Package: `org.apache.nifi:nifi-web-api` (JAVA)
- Fixed Version: 2.11.0
- CWE: CWE-862 – Missing Authorization
- Finder Credit: D0HY30N
- Jira Tracking: NIFI-16148
- Bash Commands & Codes:
Check current NiFi version curl -s http://localhost:8080/nifi-api/system-diagnostics | jq '.systemDiagnostics.aggregateSnapshot.versionInfo' Verify if vulnerable (version between 1.10.0 and 2.10.0) nifi_version=$(curl -s http://localhost:8080/nifi-api/system-diagnostics | jq -r '.systemDiagnostics.aggregateSnapshot.versionInfo.niFiVersion') if [[ "$nifi_version" > "1.10.0" && "$nifi_version" < "2.11.0" ]]; then echo "Vulnerable to CVE-2026-68979" else echo "Not vulnerable" fi Example malicious PATCH request (authorized user with Parameter Context write) curl -X PATCH http://localhost:8080/nifi-api/parameter-contexts/{context-id} \ -H "Content-Type: application/json" \ -d '{"revision":{"version":1},"parameterContext":{"parameters":[{"name":"malicious","value":"groovy:Runtime.getRuntime().exec(\"rm -rf /\")"}]}}' Upgrade to fixed version (using NiFi Toolkit) ./nifi-toolkit-2.11.0/bin/cli.sh nifi upgrade --baseUrl http://localhost:8080
Exploit:
An attacker with valid credentials and `write` permission on a Parameter Context can issue a PATCH request to the `/parameter-contexts/{id}` endpoint. By modifying a parameter that is referenced by a stopped `ExecuteScript` or similar processor, the attacker injects malicious scripting code into the parameter value. When NiFi’s automatic validation routine runs (e.g., after saving the context or during component validation), the script executes in the context of the NiFi JVM, potentially allowing arbitrary command execution, data exfiltration, or further lateral movement. The attack does not require the component to be started, and no additional authorization checks are performed on the referencing component, making the exploitation stealthy and immediate.
Protection:
- Immediate Mitigation: Upgrade to Apache NiFi 2.11.0 or later, which enforces proper authorization checks on all components affected by Parameter Context updates.
- Workaround (if upgrade is not possible): Restrict `write` permissions on Parameter Contexts to only highly trusted administrators, and avoid storing executable scripting content in parameters unless absolutely necessary.
- Network Controls: Limit access to the NiFi REST API to trusted IP ranges and enforce strong authentication (e.g., mutual TLS) to reduce the attack surface.
- Monitoring: Audit Parameter Context modification logs (
nifi-app.log) for unexpected changes, and monitor for unusual process execution or file system modifications that may indicate script injection.
Impact:
- Integrity Impact (HIGH): An attacker can alter parameter values, potentially injecting malicious scripts that modify data flows, corrupt processing logic, or tamper with downstream systems.
- Confidentiality Impact (LOW): Script execution may expose sensitive information from the NiFi environment or connected data sources.
- Availability Impact (LOW): While the vulnerability primarily affects stopped components, successful exploitation could lead to denial of service if destructive commands are executed.
- Scope (CHANGED): The vulnerable component (Parameter Context) and the impacted component (referencing processors) are distinct, meaning the breach can affect resources beyond the initial authorization boundary.
- Deployment Context: Only affects environments using component‑level authorization policies; global permission models are not susceptible.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
