This vulnerability (CVE-2026-62354) affects Apache NiFi versions 1.10.0 through 2.10.0. The core issue: the Parameter Context validation endpoint was classified as a read operation but actually mutated state. A user with read-only access could submit alternative parameter values, and the endpoint would accept them — effectively allowing read-only users to override current configuration state under the guise of 'testing' or 'validation.'
The fix in version 2.11.0 requires write access for validation requests. This is technically correct — but it breaks an operational workflow that many organizations built around: read-only users viewing parameter contexts, then testing proposed changes without requiring write privileges. The security improvement forces more accounts into write privilege roles, which expands the blast radius if those accounts are compromised.
A critical context that changes the severity assessment: NiFi's read permission is not granular. Global read access encompasses viewing process groups, dataflows, and controller configurations across the entire canvas. An attacker who already has read access has already obtained near-enterprise-wide visibility into the dataflow architecture. The validation bypass is a secondary capability, not an entry point — the reconnaissance damage is largely done at the read-access level.
The low EPSS (0.00261) reflects exploitation difficulty, not harmless theory. Exploitation requires an attacker who already has read access to parameter contexts and knowledge that the validation endpoint accepts alternative submissions. This specific combination is uncommon but not impossible.
For defenders: prioritize upgrading to 2.11.0. Review any automation, CI/CD pipelines, or monitoring integrations that relied on read-only accounts calling the validation endpoint — these will break post-patch. Consider whether your read-access grant patterns need granular scoping by canvas or component, since the current permission model trusts read-holders with substantial system knowledge. The vulnerability patched here is likely one instance of a broader pattern — convenience endpoints that transit authorization boundaries — so surface-audit other 'safe' operations for similar semantic mismatches between classification and actual behavior.