CVE-2026-68980: 
NixOS vulnerability analysis and mitigation

CVE-2026-68980 is an authorization bypass vulnerability in Apache NiFi affecting versions 2.0.0 through 2.10.0, classified as "Authorization Bypass for Parameter Context Asset Deletion." The flaw allows authenticated users with write permissions to any Parameter Context to delete Assets belonging to other Parameter Contexts by supplying an arbitrary Parameter Context Identifier without proper ownership verification. It was reported on 2026-07-27 by researcher mak3bread (Minseong Kim) and publicly disclosed on 2026-08-03. The vulnerability carries a CVSS v4.0 base score of 2.3 (Low) (GitHub Advisory, OSS-Security).

The root cause is CWE-863 (Incorrect Authorization): when processing REST API requests to delete Assets associated with Parameter Contexts, the framework authorizes the operation based solely on the caller-supplied Parameter Context Identifier without verifying that the requested Asset Identifier actually belongs to that Parameter Context (OSS-Security). An attacker with low-level (write) privileges to at least one Parameter Context can craft a DELETE request to the NiFi REST API, supplying a valid Asset Identifier from a different Parameter Context alongside an arbitrary (or their own) Parameter Context Identifier, bypassing the intended authorization boundary. The vulnerability only affects installations that implement differentiated authorization levels across multiple Parameter Contexts; environments with uniform permissions across all contexts are not impacted. The issue is tracked internally as NIFI-16154 (OSS-Security).

Successful exploitation allows an authenticated attacker to delete Assets from Parameter Contexts they are not authorized to access, potentially disrupting data pipelines and configurations that depend on those Assets. The impact is limited to the vulnerable NiFi system itself — there is no subsequent system impact — but unauthorized deletion of critical Assets could cause availability and integrity issues within affected NiFi workflows. Confidentiality impact is low, as the attack does not expose Asset contents but may reveal the existence of Assets in other Parameter Contexts through error responses (GitHub Advisory, OSS-Security).

1. Reconnaissance: Identify a target Apache NiFi instance running versions 2.0.0–2.10.0 with multiple Parameter Contexts configured under different authorization levels.
2. Authenticate: Obtain valid NiFi credentials with write permissions to at least one Parameter Context (e.g., a low-privileged user account).
3. Enumerate Assets: Use the NiFi REST API (e.g., GET /nifi-api/parameter-contexts/{id}/assets) to list Assets in the attacker-accessible Parameter Context and discover Asset Identifiers.
4. Identify target Asset: Through error probing or prior knowledge, determine the Asset Identifier of an Asset belonging to a different, unauthorized Parameter Context.
5. Craft malicious DELETE request: Send a DELETE request to the NiFi REST API endpoint for asset deletion, supplying the attacker's own (authorized) Parameter Context Identifier but the target Asset Identifier from the unauthorized context — e.g., DELETE /nifi-api/parameter-contexts/{attacker-context-id}/assets/{target-asset-id}.
6. Achieve unauthorized deletion: The framework authorizes the request based on the supplied Parameter Context Identifier without verifying Asset ownership, resulting in deletion of the Asset from the unintended context (OSS-Security, GitHub Advisory).

• Network: Unexpected DELETE requests to /nifi-api/parameter-contexts/{id}/assets/{asset-id} where the Parameter Context ID does not match the owning context of the specified Asset ID; repeated API calls from a single authenticated user targeting multiple Asset IDs across different Parameter Contexts.
• Logs: NiFi application logs (nifi-app.log) showing DELETE operations on Assets by users who do not have write permissions to the owning Parameter Context; audit log entries recording asset deletions attributed to unexpected user accounts.
• Application Behavior: Missing or unexpectedly deleted Assets in Parameter Contexts that were not modified by their authorized owners; NiFi processors or flows referencing deleted Assets beginning to fail with configuration errors.

The recommended mitigation is to upgrade Apache NiFi to version 2.11.0, which fixes the vulnerability by verifying Parameter Context ownership of the requested Asset before deletion, consistent with the approach used for Asset read operations (OSS-Security, GitHub Advisory). Organizations that cannot immediately upgrade should note that installations without differentiated authorization levels across Parameter Contexts are not subject to this vulnerability, as the framework's write permission enforcement serves as the security boundary. As a temporary workaround, administrators can enforce uniform write permissions across all Parameter Contexts to eliminate the exploitable authorization disparity until patching is feasible.

The vulnerability was reported by security researcher mak3bread (Minseong Kim) and disclosed via the Apache security mailing list and OSS-Security by Apache NiFi committer David Handermann (OSS-Security). Security news outlets including GBHackers and SecurityOnline.info covered the disclosure shortly after publication, noting the low severity but highlighting the authorization bypass nature of the flaw (GBHackers). Community reaction has been measured given the low CVSS score and narrow exploitation preconditions.