Executive brief
Apache NiFi is a data flow automation platform used to route and transform data across systems. A flaw in authorization handling allows users with only read access to Parameter Contexts to submit proposed configuration changes that override current settings, enabling them to invoke component validation methods they should not be able to modify. This could allow unauthorized configuration changes on systems where different authorization levels are enforced.
Technical details
The vulnerability is an authorization bypass in Parameter Context validation request handling. Affected versions (1.10.0 through 2.10.0) fail to properly enforce write-level authorization checks when clients submit proposed Parameter values for validation. An authenticated attacker with read access can craft validation requests that override current configuration and invoke predefined component validation methods with arbitrary settings. The attack vector is network-based and requires authentication; systems that do not enforce separate authorization levels for read and write access to Parameter Context configuration are unaffected. Apache NiFi 2.11.0 fixes the issue by requiring write access to submit validation requests.
Affected products
- Apache NiFi 1.10.0 through 2.10.0
Timeline
- 2026-08-03: disclosed
- 2026: patched: Apache NiFi 2.11.0 requires write access for validation requests