Apache NiFi Parameter Context Asset Deletion Authorization Bypass

Technical Analysis

The vulnerability arises because the NiFi framework authorizes Asset deletion requests using the client-supplied Parameter Context Identifier rather than validating it against the Identifier actually stored/owned by the target Asset, resulting in an Insecure Direct Object Reference (IDOR)-style flaw (CWE-639 class). Exploitation requires only that an attacker holds write permission on some Parameter Context, from which they can craft REST API calls referencing Asset Identifiers owned by other, more privileged Parameter Contexts to delete them. Apache NiFi 2.11.0 remediates this by applying the same ownership-verification strategy already used for Asset read operations to delete operations. Organizations that do not segment authorization across multiple Parameter Contexts are unaffected, since write permission is the sole enforced boundary in that configuration. NiFi is frequently used as an orchestration/ETL layer feeding data into RAG pipelines and AI agent workflows, so unauthorized deletion of Assets (which can include reference files, scripts, or configuration data consumed by parameterized flows) could disrupt or corrupt data feeding downstream AI agents and automated pipelines.

Affected Systems

Apache NiFi versions 2.0.0 through 2.10.0 with multi-tenant or multi-team Parameter Context configurations using differentiated authorization; not exploitable in single-authorization-tier deployments.

Indicators of Compromise

• No specific IOCs published; detection should focus on anomalous DELETE requests to /nifi-api/asset endpoints referencing Parameter Context and Asset Identifiers outside the requester's authorized scope

Remediation Steps

1. 1

   Upgrade NiFi

   Upgrade all Apache NiFi instances to version 2.11.0 or later, which validates Asset ownership against the correct Parameter Context before allowing deletion.

2. 2

   Audit Parameter Context Permissions

   Review and tighten write access to Parameter Contexts, ensuring least-privilege assignment across teams and workflows.

3. 3

   Monitor API Logs

   Review REST API access logs for unexpected Asset deletion calls involving mismatched Parameter Context and Asset Identifiers.

4. 4

   Restrict Network Access

   Limit exposure of the NiFi REST API to trusted internal networks and enforce strong authentication/authorization controls (e.g., mTLS, OIDC) until upgrade is complete.

5. 5

   Backup Assets

   Maintain backups of critical Parameter Context Assets to enable recovery in case of unauthorized deletion.