Aller au contenu
en Se connecter
Non notée

CVE-2026-66084 An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions…

Description

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint. The endpoint fails to verify that the task definition identified by code belongs to the project specified by projectCode. An authenticated user can supply the code of a project they are authorized to access together with a task definition code from another project, bypassing project access restrictions and modifying the target task definition and its upstream dependencies. This vulnerability can compromise workflow integrity and disrupt task execution in unauthorized projects.This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache DolphinScheduler 3.4 premières → < 3.4.3 3.4.3

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Apache DolphinScheduler

Les 46 CVE de Apache DolphinScheduler →
CVE-2026-71896 An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account… Non notée CVE-2026-71895 An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes… Non notée CVE-2026-71183 An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data… Non notée CVE-2026-66087 An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance… Non notée
Suivre cette CVE