Apache Nifi — CVE-2026-68979 (Critical)

Summary

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization was limited to read and write privileges on the Parameter Context itself. As a result of the missing authorization, an authenticated user authorized to modify a Parameter Context, but not authorized on referencing components, could alter Parameter values affecting those components. In deployments where a

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Apache Nifi. Patch or mitigate promptly. EPSS percentile: 28%.

Operator check

Review CVE-2026-68979 in your asset inventory. Apply patches per vendor guidance and verify Nifi is not exposed. CVSS score: 9.8. EPSS probability: 0.4%; percentile: 28%.

Sources