Apache Nifi — CVE-2026-68980 (Critical)

Date Aug 3, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Apache · Nifi

CVE CVE-2026-68980

Critical vendor advisory CVE-2026-68980

Summary

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework performed authorized based on the supplied Parameter Context Identifier without verifying the requested Identifier against the stored Identifier. Apache NiFi installations that do not implement different levels of authorization across Parameter Contexts are not subject to this vulnerability, because t

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.1) in Apache Nifi. Patch or mitigate promptly. EPSS percentile: 18%.

Operator check

Review CVE-2026-68980 in your asset inventory. Apply patches per vendor guidance and verify Nifi is not exposed. CVSS score: 9.1. EPSS probability: 0.3%; percentile: 18%.

Sources

NVD — CVE-2026-68980 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed