Do Son 
TL;DR
Four new Apache NiFi vulnerabilities affect installations running versions prior to 2.11.0. These flaws allow attackers to execute code, bypass authorization, and consume system resources. Therefore, users must update their software immediately to secure their data pipelines.
- Product: Apache Software Foundation Apache NiFi
- Vulnerabilities: 4 flaws (CVE-2026-68979, CVE-2026-62354, CVE-2026-68980, CVE-2026-68981)
- Highest severity: 8.8 (High · CVSSv4)
- Worst impact: Uncontrolled Resource Consumption through Decompression of HTTP Requests
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-68981 | 8.8 | Uncontrolled Resource Consumption through Decompression of HTTP Requests | — | Not exploited |
| CVE-2026-62354 | 7.7 | Incorrect Authorization for Parameter Context Validation Requests | — | Not exploited |
| CVE-2026-68979 | 5.9 | Missing Authorization for Components Referenced by Parameter Context Updates | — | Not exploited |
| CVE-2026-68980 | 2.3 | Authorization Bypass for Parameter Context Asset Deletion | — | Not exploited |
Why It Matters
Thousands of companies worldwide use Apache NiFi to process data. These Apache NiFi vulnerabilities threaten critical event pipelines. Modern generative AI pipelines also rely on this framework. Successful attacks could disrupt operations or expose sensitive information. Breaching these systems gives attackers access to internal networks. At this time, no such activity has been confirmed in the wild.
How the Attacks Work
Two authorization flaws exist in Parameter Context management. First, CVE-2026-68979 allows users to modify parameter values without checking referencing components. This action can trigger code execution during automatic component validation. The framework does not require the referencing component to start. Second, CVE-2026-62354 lets users with read access submit validation requests. Attackers can override current configurations using this method. These overridden values bypass standard security boundaries.
Additionally, CVE-2026-68980 permits unauthorized asset deletion by failing to verify ownership. The framework checks the supplied identifier instead of the stored one. Finally, CVE-2026-68981 causes uncontrolled resource consumption through HTTP requests. The REST API handles gzip-encoded requests using a Jersey filter. The framework checks the compressed payload size instead of the decompressed output. Consequently, this flaw allows malicious crafted gzip requests to drain system memory.
Affected Versions
These Apache NiFi vulnerabilities impact specific release branches. Most flaws affect versions 1.10.0 through 2.10.0. Furthermore, the asset deletion bug impacts versions 2.0.0 through 2.10.0. The memory exhaustion issue affects versions 1.5.0 through 2.10.0. Installations lacking component-level authorization policies remain partially insulated. However, relying on default settings provides incomplete protection.
Patch and Mitigation Steps
Upgrading to version 2.11.0 is the recommended mitigation. The Apache team has released this update to address all four issues. This new version requires proper write access for validation requests. Administrators should download Apache NiFi directly from the official project site. Applying this update secures the system boundaries and disables vulnerable gzip decompression. Response compression now operates safely through the Jetty Server.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
