Skip to content
OpenAdvisories
High WID-SEC-2026-2639 4 CVEs

Apache Nifi: Mehrere Schwachstellen

Published Aug 3, 2026 · Updated Aug 3, 2026 · de-DE

Vendor: Apache Product: Nifi Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Nifi ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, einen Denial-of-Service-Zustand auszulösen oder möglicherweise beliebigen Code auszuführen.

Product

Apache Nifi ist ein System zur Verarbeitung und Verteilung von Daten. Es unterstützt skalierbare gerichtete Graphen der Datenweiterleitung, -transformation und Systemvermittlungslogik.

Vulnerabilities 4

  • High 8.8
    CVE-2026-68981

    Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests

    Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing…

    Apache Software Foundation Apache NiFi
  • High 7.7
    CVE-2026-62354

    Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests

    Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to i…

    Apache Software Foundation Apache NiFi
  • Medium 5.9
    CVE-2026-68979

    Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates

    Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing comp…

    Apache Software Foundation Apache NiFi
  • Low 2.3
    CVE-2026-68980

    Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion

    Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifi…

    Apache Software Foundation Apache NiFi

Revision history

  1. #1

    Initiale Fassung

References