This is an automated email from the ASF dual-hosted git repository. exceptionfactory pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/nifi-site.git
commit 757d0d53bac11463aec38c0e088e7748e20a8ab0 Author: exceptionfactory <[email protected]> AuthorDate: Mon Aug 3 14:58:01 2026 -0500 NIFI-16112 Published CVE-2026-62354 --- content/documentation/security.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/content/documentation/security.md b/content/documentation/security.md index c65b2e78..b6755cc8 100644 --- a/content/documentation/security.md +++ b/content/documentation/security.md @@ -71,6 +71,25 @@ Severity ratings represent the determination of project members based on an eval The following announcements include published vulnerabilities that apply directly to Apache NiFi components. +{{< vulnerability +id="CVE-2026-62354" +title="Incorrect Authorization for Parameter Context Validation Requests" +published="2026-08-03" +severity="High" +products="Apache NiFi" +affectedVersions="1.10.0 to 2.10.0" +fixedVersion="2.11.0" +jira="NIFI-16112" +pullRequest="11429" +reporter="Nguyen Van Hiep from MBBank" >}} + +Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override +current configuration, enabling users with read access to invoke predefined component validation methods with alternative settings. Apache NiFi installations that do not implement different levels of +authorization for viewing and modifying Parameter Context configuration are not subject to this vulnerability. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, requiring write access to +submit Parameter Context validation requests. + +{{</ vulnerability >}} + {{< vulnerability id="CVE-2026-54665" title="Missing Validation for Proxy Host Headers"
