Executive brief
Apache NiFi is a data flow automation and processing platform used in enterprise environments to manage and execute data pipelines. A security flaw in versions 1.10.0 through 2.10.0 allows authenticated users with limited permissions to modify parameter values that affect other components, potentially leading to unauthorized code execution. This bypasses intended access controls, putting sensitive data pipelines and operations at risk.
Technical details
The vulnerability is an authorization bypass in the Parameter Context update REST API method. The API fails to validate whether the authenticated user has authorization on components that reference the parameters being modified, enforcing only read/write checks on the Parameter Context itself. An attacker with permission to modify a Parameter Context but not the referencing components can alter parameter values, which during automatic component validation can execute embedded scripting code without requiring the component to be running. The impact is limited to stopped components by existing verification checks and only affects deployments with component-level authorization policies. Patching to Apache NiFi 2.11.0 aligns authorization requirements across all Parameter Context methods.
Affected products
- Apache NiFi 1.10.0 through 2.10.0
Timeline
- 2026-08-03: disclosed: Public disclosure via oss-security mailing list
- 2026-08-03: patched: Fix available in Apache NiFi 2.11.0