SB20260824142 - Multiple vulnerabilities in Apache Nifi

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260824142

SB20260824142 - Multiple vulnerabilities in Apache Nifi

Published: August 24, 2026

Security Bulletin ID SB20260824142
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Incorrect authorization (CVE-ID: CVE-2026-68979)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper access control in the Parameter Context update REST API when updating parameter values referenced by components. A remote user can modify a Parameter Context without authorization on referencing components to execute arbitrary code.

Exploitation requires deployments that use component-level authorization policies, and the impact is limited to stopped components. Code execution is possible only when a Parameter value contains executable scripting content and automatic component validation processes the updated value.


2) Improper access control (CVE-ID: CVE-2026-62354)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to invoke predefined component validation methods with alternative settings.

The vulnerability exists due to improper access control in Parameter Context validation requests when handling validation submissions with proposed Parameter values. A remote user can submit proposed Parameter values to invoke predefined component validation methods with alternative settings.

Only installations that implement different authorization levels for viewing and modifying Parameter Context configuration are vulnerable.


3) Improper access control (CVE-ID: CVE-2026-68980)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to delete assets associated with other parameter contexts.

The vulnerability exists due to improper access control in the parameter context asset deletion REST API when handling asset deletion requests using a supplied parameter context identifier and asset identifier. A remote user can submit a crafted deletion request with mismatched identifiers to delete assets associated with other parameter contexts.

Only installations that implement different authorization levels across parameter contexts are affected.


4) Resource exhaustion (CVE-ID: CVE-2026-68981)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the Jersey encoding filter for the application REST API when processing gzip-encoded HTTP requests. A remote attacker can send a specially crafted compressed request to cause a denial of service.

The maximum request size is enforced on the compressed payload rather than the decompressed output.


Remediation

Install update from vendor's website.

References