898 matches found
CVE-2026-62354
CVE-2026-62354 affects Apache NiFi 1.10.0–2.10.0. The issue is an authorization flaw in handling Parameter Context validation requests: users with READ access can submit proposed Parameter values, allowing them to override current configuration and invoke component validation methods with alterna...
CVE-2026-68979 Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates
Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...
CVE-2026-68979
Summary (CVE-2026-68979): Apache NiFi versions 1.10.0–2.10.0 expose a Parameter Context update REST API that does not enforce authorization on components referencing Parameter values. An authenticated user able to modify a Parameter Context but not authorized on referencing components could alter...
CVE-2026-68979 Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates
Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...
CVE-2026-68979 Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates
Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...
CVE-2026-68979
Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...
PT-2026-67496
Name of the Vulnerable Software and Affected Versions Apache NiFi versions 2.0.0 through 2.10.0 Description Apache NiFi allows the creation, reading, and deletion of Assets associated with Parameter Contexts via the REST API. The framework authorizes asset deletion using the provided Parameter...
PT-2026-67494
Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.10.0 through 2.10.0 Description Authorization handling for Parameter Context validation requests allows clients with read access to submit proposed Parameter values. These proposed values override the current...
PT-2026-67497
Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.5.0 through 2.10.0 Description The application REST API supports gzip-encoded HTTP requests via a Jersey encoding filter. The framework enforces a maximum request size on the compressed payload instead of the decompresse...
PT-2026-67495
Name of the Vulnerable Software and Affected Versions Apache NiFi versions 1.10.0 through 2.10.0 Description A Parameter Context update REST API method fails to enforce authorization checks on components that reference parameter values. While framework authorization was limited to read and write...
GHSA-88FW-V6X4-3F58 vulnerabilities
Vulnerabilities for packages: apache-nifi-registry...
CVE-2026-41695 vulnerabilities
Vulnerabilities for packages: apache-nifi-registry...
GHSA-88FW-V6X4-3F58 vulnerabilities
Vulnerabilities for packages: apache-nifi-registry, camunda-zeebe...
CVE-2026-41695 vulnerabilities
Vulnerabilities for packages: apache-nifi-registry, camunda-zeebe...
GHSA-3CHG-M5W7-QFV5 vulnerabilities
Vulnerabilities for packages: apache-nifi-registry...
GHSA-72PG-X5F8-J25J vulnerabilities
Vulnerabilities for packages: apache-nifi-registry...
GHSA-957G-F97V-VPPC vulnerabilities
Vulnerabilities for packages: apache-nifi-registry...
GHSA-CJPG-RGQ5-FR37 vulnerabilities
Vulnerabilities for packages: apache-nifi-registry...