CVE-2026-68980 in NiFi
Summary
by MITRE • 08/03/2026
Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework performed authorized based on the supplied Parameter Context Identifier without verifying the requested Identifier against the stored Identifier. Apache NiFi installations that do not implement different levels of authorization across Parameter Contexts are not subject to this vulnerability, because the framework enforces write permissions as the security boundary. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which verifies Parameter Context ownership of the requested Asset before deletion using the same strategy applied to Asset read operations.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability exists in Apache NiFi versions 2.0.0 through 2.10.0 where the system fails to properly validate asset deletion operations against parameter contexts. The flaw stems from a lack of proper authorization verification during asset deletion processes, specifically when using the REST API to manage assets associated with parameter contexts. The framework incorrectly authorizes asset deletions based solely on the provided parameter context identifier without first confirming that the requested asset actually belongs to the specified parameter context. This represents a classic authorization bypass vulnerability where the system accepts user-provided identifiers without proper validation against stored data, creating a potential path for unauthorized access and manipulation of resources.
The technical implementation flaw manifests in how Apache NiFi handles parameter context ownership verification during asset operations. When a user attempts to delete an asset through the REST API, the system uses the parameter context identifier provided in the request to determine authorization permissions. However, it fails to cross-reference this identifier with the actual stored identifiers associated with the asset, allowing attackers to potentially delete assets that belong to different parameter contexts than those specified in their requests. This vulnerability is categorized under CWE-862 which specifically addresses "Missing Authorization" and falls within the ATT&CK technique T1078 which covers valid accounts and credential access.
The operational impact of this vulnerability extends beyond simple unauthorized deletions, potentially allowing malicious actors to manipulate parameter contexts and affect system configuration integrity. Since parameter contexts control configuration settings for processors and other components within NiFi, unauthorized deletion of assets could disrupt workflows or provide attackers with opportunities to modify system behavior. The vulnerability is particularly concerning in environments where multiple parameter contexts exist and where the system does not implement granular authorization boundaries. Systems that rely on parameter context ownership as their primary security boundary are especially at risk.
The recommended mitigation involves upgrading to Apache NiFi version 2.11.0 or later, which implements proper validation of parameter context ownership before allowing asset deletion operations. This fix aligns with the same verification strategy already applied to asset read operations, ensuring consistency in authorization checking. The updated implementation validates that the requested asset identifier corresponds to the parameter context identifier provided in the request, preventing cross-context deletions. Organizations should also review their existing parameter context configurations and authorization policies to ensure appropriate segregation of duties and access controls are maintained across different parameter contexts. Additionally, security monitoring should be implemented to detect unusual asset deletion patterns that might indicate exploitation attempts.