Loading story…
Apache disclosed CVE-2026-68980, a low-severity authorization bypass in Apache NiFi affecting nifi-web-api versions 2.0.0 through 2.10.0. The flaw allows improper deletion of Parameter Context assets through the REST API because the application authorized deletion using a supplied Parameter Context identifier without confirming that it matched the asset’s stored owner. The issue is tracked internally as NIFI-16154 and was reported by mak3bread (Minseong Kim).
Apache said deployments that do not apply different authorization levels across Parameter Contexts are unlikely to see practical impact, because write permissions remain the effective security boundary. The project released a fix in NiFi 2.11.0, which validates Parameter Context ownership before deletion using the same approach already used for asset read operations, and advised affected users to upgrade.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
David Handermann publicly disclosed CVE-2026-68980 on the oss-sec mailing list. The advisory described a low-severity authorization bypass in Apache NiFi that could allow unauthorized deletion of Parameter Context assets in certain deployments.
Apache NiFi authorization bypass issue NIFI-16154, later assigned CVE-2026-68980, was reported by mak3bread (Minseong Kim). The flaw involved improper authorization of Parameter Context asset deletion through the REST API.
Apache recommended upgrading to NiFi 2.11.0, which fixes the issue by validating that the requested asset belongs to the authorized Parameter Context before deletion. The vulnerability affects nifi-web-api versions 2.0.0 through 2.10.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Apache NiFi** disclosed a high-severity authorization flaw, tracked as **CVE-2026-25903**, that allows a lower-privileged user to modify configuration properties of *Restricted* extension components after they have been added to a flow by a more privileged user. The issue affects NiFi versions **1.1.0 through 2.7.2** and stems from **missing authorization checks** during component property updates: the framework enforced the extra privileges required to *add* a Restricted component, but did not consistently re-check the component’s restricted status when *updating* it, enabling an authorization bypass (CWE-862). Potential impact includes tampering with dataflow logic and, depending on the component and environment, enabling unsafe actions such as triggering sensitive operations or altering processing behavior. Risk is conditional on deployments that implement distinct authorization levels for Restricted components; installations that do **not** differentiate authorization levels are described as not subject to this specific bypass because standard write permissions remain the effective security boundary. **Upgrading to NiFi 2.8.0** is the recommended mitigation, and the issue was reported via responsible disclosure (credited to **David Handermann** in reporting). CVE records also reference public advisories and include a **CVSS v4.0** vector indicating network reachability and high potential impact, while noting prerequisites such as the need for a privileged user to have already introduced the Restricted component into the flow.
Jun 29, 2026Apache NiFi fixed **CVE-2026-39816**, a high-severity flaw that lets authenticated users execute arbitrary code without the `EXECUTE_CODE` permission when certain optional graph extensions are installed, particularly `nifi-other-graph-services-nar`. The issue affects NiFi versions **2.0.0-M1 through 2.8.0** and stems from the `TinkerpopClientService`, which can compile and run user-supplied **Groovy** code before submitting a graph query. Apache attributed the bug to a missing restricted annotation tied to the Execute Code required permission, creating a privilege-boundary bypass in deployments using TinkerPop graph query features. The vulnerability was reported by **John Walker of ZeroPath** and tracked as `NIFI-15800`, with Apache addressing it in **NiFi 2.9.0**. ZeroPath said the flaw reflects a mismatch in NiFi’s privilege model, where graph query functionality was not treated as a code-execution path even though TinkerPop’s native query mode can trigger server-side code execution; the researchers also published a proof of concept showing shell access on a vulnerable server. Organizations running affected NiFi deployments are advised to upgrade to **2.9.0 or later** or remove the impacted optional graph-related NAR extensions if an upgrade cannot be completed immediately.
Jun 29, 2026
Apache disclosed **CVE-2026-59083**, a vulnerability in Tomcat's `RewriteValve` caused by incorrect URL decoding of hex-encoded characters that can let attackers bypass security controls in some configurations. The issue is classified as **CWE-177** and was described as low severity by Apache, though the CVE record notes network attackability with low attack complexity, no privileges required, and no user interaction. Apache said the flaw affects supported Tomcat branches **11.0.0-M1 through 11.0.23**, **10.1.0-M1 through 10.1.56**, and **9.0.0.M1 through 9.0.119**, with reports also listing **8.5.0 through 8.5.100** as affected. Apache and downstream advisories urged users to upgrade to fixed releases **11.0.24**, **10.1.57**, or **9.0.120**, while warning that older unsupported versions may also be vulnerable; versions before **8.0.0** were noted as unaffected in the oss-security disclosure. The vulnerability was published through Apache security pages, the Apache mailing list, and `oss-security`, with the CVE entry updated to include affected-version details, a CVSS v3.1 vector, and a CISA SSVC assessment.
Aug 28, 2026