Dashboard / CVE-2026-62354

CVE-2026-62354

HIGH
MEDIUM Priority: 0.04 BB Relevance: 65/100
Published: 2026-08-03 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: P
AT: Present
VC: High
VI: High
VA: High

Description

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation methods with alternative settings. Apache NiFi installations that do not implement different levels of authorization for viewing and modifying Parameter Context configuration are not subject to this vulnerability. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, requiring write access to submit Parameter Context validation requests.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
apache nifi 1.10.0 – 2.11.0

References & Advisories (2)

Bug Bounty Relevance

65 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.7 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:I/V:C/RE:L/U:Amber

EPSS — Exploitation Probability

0.45%
Raw Score 0.004540
Percentile 39.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00454
2026-10-28
0.00454

Intelligence Sources

nvd ref →

External Links