CVE-2026-68980: 
NixOS vulnerability analysis and mitigation

CVE-2026-68980 is an authorization bypass vulnerability in Apache NiFi affecting versions 2.0.0 through 2.10.0, classified as "Authorization Bypass for Parameter Context Asset Deletion." The flaw allows attackers to delete Assets associated with Parameter Contexts via the REST API without proper ownership verification. It was reported on 2026-07-27 by researcher mak3bread (Minseong Kim) and publicly disclosed on 2026-08-03. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 2.3 (Low), reflecting differing scoring methodologies (GitHub Advisory, OSS-Sec).

The root cause is CWE-863 (Incorrect Authorization): the NiFi REST API framework authorizes asset deletion requests by checking write permissions against the supplied Parameter Context Identifier without verifying that the requested Asset Identifier actually belongs to that Parameter Context in the stored data. This means an attacker with write access to one Parameter Context can supply a different Parameter Context's Asset Identifier in a deletion request and successfully delete assets they should not have access to. The vulnerability only affects installations that implement differentiated authorization levels across Parameter Contexts; environments with uniform permissions are not impacted. The issue is tracked internally as NIFI-16154 (OSS-Sec, GitHub Advisory).

Successful exploitation allows an attacker to delete Assets from Parameter Contexts they are not authorized to modify, compromising data integrity and potentially disrupting NiFi data flow configurations that depend on those assets. Sensitive configuration parameters stored as Assets — such as credentials, certificates, or pipeline configurations — could be destroyed, leading to service disruption or forcing administrators to reconfigure affected Parameter Contexts. The confidentiality and availability impacts are limited in scope, but integrity impact is high for organizations relying on differentiated Parameter Context authorization as a security boundary (GitHub Advisory, OSS-Sec).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.26–0.318%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Exploitation requires the attacker to have at least low-level privileges (write access to at least one Parameter Context) and the target installation to use differentiated authorization across Parameter Contexts (OSS-Sec).

1. Reconnaissance: Identify Apache NiFi instances running versions 2.0.0–2.10.0 that expose the REST API, and confirm the target uses differentiated authorization levels across multiple Parameter Contexts.
2. Obtain credentials: Acquire credentials or an API token with write access to at least one Parameter Context (e.g., via a low-privileged user account).
3. Enumerate Parameter Contexts and Assets: Use the NiFi REST API (e.g., GET /nifi-api/parameter-contexts) to enumerate available Parameter Contexts and their Asset Identifiers, including those belonging to Parameter Contexts the attacker is not authorized to modify.
4. Craft malicious deletion request: Send a DELETE request to the asset deletion endpoint, supplying the attacker's authorized Parameter Context Identifier in the authorization field but specifying the Asset Identifier of an asset belonging to a different, restricted Parameter Context.
5. Achieve unauthorized deletion: Because the framework validates only the supplied Parameter Context Identifier (which the attacker controls) without cross-checking asset ownership, the deletion succeeds, removing the targeted asset from the restricted Parameter Context (OSS-Sec, GitHub Advisory).

• Network: Unexpected DELETE requests to NiFi REST API asset endpoints (e.g., /nifi-api/parameter-contexts/{id}/assets/{assetId}) where the Parameter Context ID in the URL does not match the expected owner of the referenced Asset ID.
• Logs: NiFi application logs showing asset deletion events attributed to users who do not have write permissions on the affected Parameter Context; audit log entries with mismatched Parameter Context and Asset ownership.
• Application Behavior: Missing Assets in Parameter Contexts that were not intentionally deleted by authorized administrators; NiFi data flows failing due to missing configuration assets or credentials.

The recommended remediation is to upgrade to Apache NiFi 2.11.0, which introduces ownership verification of the requested Asset against its stored Parameter Context before allowing deletion — mirroring the validation already applied to Asset read operations (OSS-Sec, GitHub Advisory). For organizations unable to upgrade immediately, restrict REST API access to trusted users only and avoid relying on differentiated Parameter Context authorization as a security boundary until patched. Installations that do not implement different authorization levels across Parameter Contexts are not affected by this vulnerability.

The vulnerability received coverage from several cybersecurity news outlets including GBHackers, CyberPress, CyberSecurityNews, and SecurityOnline shortly after disclosure, generally framing it as part of a broader set of Apache NiFi security fixes in version 2.11.0. The Apache NiFi security advisory was announced via the Apache mailing list and oss-security by David Handermann. Community reaction has been measured given the low exploitation probability and the conditional nature of the vulnerability (requiring differentiated Parameter Context authorization). No significant controversy or notable researcher commentary beyond the initial disclosure has been observed.