CVE-2026-68979 Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...

CVE-2026-68979

Apache NiFi 1.10.0–2.10.0 exposes a Parameter Context update REST API that does not enforce authorization on components referencing parameter values. An authenticated user with permission to modify a Parameter Context but without component-level authorization could alter parameter values, potenti...