Apache NiFi users should upgrade to version 2.11.0 following the project's disclosure of four security vulnerabilities impacting the NiFi Web API and parameter context authorization controls This article explores vulnerabilities impacting nifi. . These flaws could lead to authorization bypass, unauthorized configuration changes, validation abuse, memory exhaustion, and in some deployments, code execution through manipulated parameter values.
The flaw enabled users with read privileges to send validation requests containing proposed parameter values, which could override current configuration settings during the process. However, it lacks validation to ensure the Asset belongs to the specified context, potentially enabling users to delete assets linked to other contexts in environments with differing authorization levels.
An attacker could exploit this by sending a small gzip-compressed request that expanded significantly upon decompression, leading to excessive memory consumption and potential denial-of-service conditions. CVE NiFi Issue Severity Affected Versions Vulnerability Details Potential Impact Fixed Version Reporter CVE-2026-68981 NIFI-16152 High 1.5.0–2.10.0 NiFi enforced maximum request size against compressed gzip payloads rather than decompressed request data in its REST API, leading to excessive memory consumption and denial of service through crafted gzip-compressed requests. 2.11.0 mak3bread (Minseong Kim) CVE-2026-68980 NIFI-16154 Low 2.0.0–2.10.0 Asset deletion authorization relied on a supplied Parameter Context identifier without confirming that the requested Asset belonged to that context, resulting in unauthorized deletion of Parameter Context Assets in deployments with differentiated authorization policies.
