CVE-2026-23902: Apache DolphinScheduler Incorrect Authorization Vulnerability
Summary
CVE-2026-23902: Apache DolphinScheduler has an Incorrect Authorization Vulnerability. Affects org.apache.dolphinscheduler:dolphinscheduler versions < 3.4.1. Fixed in 3.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache DolphinScheduler is an open-source distributed workflow scheduler designed for managing and orchestrating complex workflows in data processing and analysis. It provides a user-friendly interface and supports multi-tenant architecture, allowing multiple users to operate within the same environment. However, a significant security flaw has been identified that permits unauthorized access to tenant resources during workflow execution.
Vulnerability Detail
The Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to access and utilize tenants that are not defined on the platform during workflow execution. This flaw arises from inadequate checks on user permissions, potentially leading to unauthorized data access and manipulation. The vulnerability affects versions prior to 3.4.1, and if exploited, it can result in data breaches and unauthorized actions within the system.
How To Fix
Minimum fixed version
3.4.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to upgrade to the patched version as mentioned above.
Conclusion
The Incorrect Authorization vulnerability in Apache DolphinScheduler poses significant risks to data security and integrity. Users are strongly advised to upgrade to version 3.4.1 or later to mitigate these risks effectively. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for org.apache.dolphinscheduler:dolphinscheduler →
FAQ
CVE-2026-23902 is a vulnerability in Apache DolphinScheduler that allows unauthorized access to tenant resources during workflow execution.
All versions prior to 3.4.1 are affected by this vulnerability.
Exploitation of this vulnerability can lead to unauthorized data access and manipulation, resulting in data breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.dolphinscheduler:dolphinscheduler.
