CVE-2026-68979

{"id": "CVE-2026-68979", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68979", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T03:57:10.983249Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"Safety": "NEGLIGIBLE", "version": "4.0", "Recovery": "USER", "baseScore": 5.9, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:L/U:Clear", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "CLEAR", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "LOW", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache NiFi", "versions": [{"status": "affected", "version": "1.10.0", "versionType": "semver", "lessThanOrEqual": "2.10.0"}], "packageName": "org.apache.nifi:nifi-web-api", "defaultStatus": "unaffected"}]}], "published": "2026-08-03T20:17:28.977", "references": [{"url": "https://lists.apache.org/thread/xwz8wsss2ovx07tns96rkc3n7cm4xfrq", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/03/10", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization was limited to read and write privileges on the Parameter Context itself. As a result of the missing authorization, an authenticated user authorized to modify a Parameter Context, but not authorized on referencing components, could alter Parameter values affecting those components. In deployments where a Parameter value contains executable scripting content, updating a Parameter can result in code execution during automatic component validation, without starting the referencing component. The impact was limited to stopped components by existing verification checks, and the issue applies only to deployments that use component-level authorization policies. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which aligns the Parameter Context update method authorization with other methods, adding authorization checking on affected components."}, {"lang": "es", "value": "Apache NiFI 1.10.0 hasta 2.10.0 proporcionan un m\u00e9todo de API REST de actualizaci\u00f3n de Contexto de Par\u00e1metros que no aplica la verificaci\u00f3n de autorizaci\u00f3n en componentes que referencian valores de Par\u00e1metros. Actualizar un Contexto de Par\u00e1metros puede cambiar valores de par\u00e1metros que afectan a los componentes que los referencian, pero la autorizaci\u00f3n del framework estaba limitada a privilegios de lectura y escritura en el propio Contexto de Par\u00e1metros. Como resultado de la autorizaci\u00f3n faltante, un usuario autenticado autorizado para modificar un Contexto de Par\u00e1metros, pero no autorizado en los componentes que los referencian, podr\u00eda alterar valores de Par\u00e1metros que afectan a esos componentes. En implementaciones donde un valor de Par\u00e1metro contiene contenido de scripting ejecutable, actualizar un Par\u00e1metro puede resultar en la ejecuci\u00f3n de c\u00f3digo durante la validaci\u00f3n autom\u00e1tica del componente, sin iniciar el componente que lo referencia. El impacto estaba limitado a componentes detenidos por las verificaciones de verificaci\u00f3n existentes, y el problema se aplica solo a implementaciones que utilizan pol\u00edticas de autorizaci\u00f3n a nivel de componente. Actualizar a Apache NiFi 2.11.0 es la mitigaci\u00f3n recomendada, que alinea la autorizaci\u00f3n del m\u00e9todo de actualizaci\u00f3n del Contexto de Par\u00e1metros con otros m\u00e9todos, a\u00f1adiendo verificaci\u00f3n de autorizaci\u00f3n en los componentes afectados."}], "lastModified": "2026-10-23T21:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:nifi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62B90D58-2E7A-47A1-BAB4-92F7D88C4F49", "versionEndExcluding": "2.11.0", "versionStartIncluding": "1.10.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}