Apache NiFi Vulnerabilities Enable Authorization Bypass Attacks

Cybersecuritynews •Abinaya • August 4, 2026

Apache NiFi users should upgrade to version 2.11.0 after the project disclosed four security vulnerabilities affecting the NiFi Web API and Parameter Context authorization controls. The flaws could enable authorization bypass, unauthorized configuration changes, validation abuse, memory exhaustion, and, in specific deployments, code execution through manipulated parameter values. The security issues affect Apache NiFi versions […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Apache NiFi Vulnerabilities Lead to Authorization Bypass and Memory Issues Apache NiFi has disclosed four critical vulnerabilities affecting its Web API and Parameter Context authorization controls. Users are urged to upgrade to version 2.11.0 to mitigate risks of authorization bypass, unauthorized configuration changes, and memory exhaustion. The vulnerabilities allow attackers to exploit the system via specially crafted gzip-compressed HTTP requests, leading to potential unauthorized deletion of assets and code execution in specific deployments. Affected versions range from 1.5.0 to 2.10.0. The vulnerabilities have been classified with high severity due to their potential impact on system integrity and availability. Users are advised to take immediate action to secure their installations. 2 sources 69

Extracted Entities

CWE Weaknesses (3)

CWE-20 - Improper Input Validation CWE-287 - Improper Authentication Cwe-400 - Uncontrolled Resource Consumption

Platforms (1)

Apache NiFi