PatchTheCVEnifi vulnerabilities and fixes
Recent CVEs affecting nifi, with upgrade or downgrade steps. 4 tracked.
nifi has 4 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-08-03. Highest priority: CVE-2026-68979 (score 58/100).
- CVE-2026-68979 CRITICAL 9.8 UPGRADE Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce aut
- CVE-2026-68980 CRITICAL 9.1 UPGRADE Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Cont
- CVE-2026-68981 HIGH 7.5 UPGRADE Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jerse
- CVE-2026-62354 MEDIUM 4.3 UPGRADE Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows c
FAQ
How do I fix nifi vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is nifi being exploited right now?
None of the tracked nifi CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which nifi CVE should I patch first?
CVE-2026-68979 currently ranks highest (58/100): Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce aut.