CVE-2026-68979: 
NixOS vulnerability analysis and mitigation

CVE-2026-68979 is a missing authorization vulnerability in Apache NiFi's Parameter Context update REST API, officially titled "Missing Authorization for Components Referenced by Parameter Context Updates." It affects Apache NiFi versions 1.10.0 through 2.10.0 (specifically the org.apache.nifi:nifi-web-api component). The vulnerability was reported on 2026-07-22 by researcher D0HY30N and publicly disclosed on 2026-08-03 via the Apache security mailing list. It carries a CVSS v4.0 base score of 5.9 (Medium) (Apache Advisory, GitHub Advisory, OSS-Sec).

The root cause is CWE-862 (Missing Authorization): the Parameter Context update REST API endpoint (PUT /parameter-contexts/{id}) enforced authorization only on the Parameter Context resource itself — checking read/write privileges — but did not verify whether the requesting user had authorization on components that reference those parameters. An authenticated attacker with write access to a Parameter Context can therefore modify parameter values consumed by components they are not authorized to access. In deployments where parameter values contain executable scripting content (e.g., used in ExecuteScript or InvokeScriptedProcessor components), the NiFi framework automatically validates stopped components upon parameter changes, which triggers script execution without the component needing to be started. The issue is tracked internally as NIFI-16148 and only affects deployments using component-level authorization policies (Apache Advisory, OSS-Sec).

A successful exploit allows an authenticated but partially privileged user to tamper with parameter values affecting components they are not authorized to modify, violating the integrity of those components' configurations. In the most severe scenario — deployments using executable scripting content in parameters — the attacker can achieve remote code execution on the NiFi server during automatic component validation of stopped components, without ever starting the component. Confidentiality impact is limited (low), availability impact is low, but integrity impact on the vulnerable system is rated high, with additional low-level impacts on subsequent systems (GitHub Advisory, Apache Advisory).

1. Reconnaissance: Identify an Apache NiFi instance running versions 1.10.0–2.10.0 that uses component-level authorization policies and has Parameter values containing executable scripting content (e.g., Groovy or Python scripts in ExecuteScript processors).
2. Obtain credentials: Acquire valid NiFi credentials for an account that has write access to at least one Parameter Context but lacks authorization on the scripting components that reference those parameters.
3. Identify target Parameter Context: Use the NiFi REST API or UI to enumerate Parameter Contexts and identify one whose parameters are referenced by scripting components (e.g., GET /nifi-api/parameter-contexts).
4. Craft malicious parameter value: Prepare a modified parameter value containing a malicious executable script payload (e.g., a reverse shell command embedded in a Groovy script).
5. Submit the update: Send a PUT request to /nifi-api/parameter-contexts/{id} with the crafted payload. The API does not check authorization on referencing components, so the update is accepted.
6. Trigger automatic validation: NiFi automatically validates stopped components that reference the updated parameter. During this validation, the scripting component executes the injected script content, achieving code execution on the NiFi server without the component being started (Apache Advisory, OSS-Sec).

• Network: Unexpected PUT requests to /nifi-api/parameter-contexts/{id} from user accounts not typically associated with that Parameter Context; outbound connections from the NiFi server process to unknown external IPs following a parameter update.
• Logs: NiFi application logs (nifi-app.log) showing parameter context updates by users who do not own or normally access the modified context; validation events on stopped scripting components immediately following a parameter update.
• Process: Unusual child processes spawned by the NiFi JVM process (e.g., bash, sh, curl, wget, python) during component validation phases, particularly when no components were manually started.
• File System: Unexpected scripts, binaries, or web shells written to the NiFi working directory or temp directories by the NiFi service account following a parameter context update.

The primary remediation is to upgrade Apache NiFi to version 2.11.0 or later, which adds proper authorization checking on all components referencing a Parameter Context during update operations, aligning this API method with the authorization behavior of other NiFi methods (Apache Advisory). As a workaround for organizations unable to upgrade immediately, restrict Parameter Context modification privileges exclusively to fully trusted administrators, and avoid storing executable scripting content directly in Parameter values. Deployments that do not use component-level authorization policies are not affected by this vulnerability.

The vulnerability was covered by security news outlets including GBHackers and SecurityOnline shortly after disclosure, noting the authorization bypass risk in NiFi deployments using scripting components (GBHackers, SecurityOnline). The DailyCyberSecurity Mastodon account also flagged the advisory for community awareness. Overall community sentiment treats this as a moderate but targeted risk, given the specific preconditions required for exploitation.