CVE-2026-62354: Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The propo

unknownCVE-2026-62354

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying Parameter Context configuration are not subject to this vulnerability. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, requiring write access to submit Parameter Context validation requests.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: unknown
Published: 2026-08-03
Last updated: 2026-08-05
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-62354

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-623540.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-62354	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEU] [hoch] Apache Nifi: Mehrere Schwachstellencert-bund

Recent advisories for Authorization handling for

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-14843: The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is autho…nvd · 2026-07-31
highCVE-2026-65922: An authorization weakness in JFrog Artifactory internal metadata handling could allow a user w…nvd · 2026-07-27
highCVE-2026-42017: An event-handling weakness in JFrog Artifactory could expose privileged authorization material…nvd · 2026-07-27
criticalCVE-2026-15704: In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments ar…nvd · 2026-07-24
mediumCVE-2024-58364: SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span r…nvd · 2026-07-18
mediumCVE-2024-58361: SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the pa…nvd · 2026-07-18