As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-66087: Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint
Apache DolphinScheduler versions before 3.4.3 contain an authorization bypass vulnerability in the task instance stop and savepoint endpoints. Authenticated users can operate on task instances in projects they lack permission to access, bypassing project-level authorization checks.
Why it matters: Organizations running DolphinScheduler before 3.4.3 must upgrade immediately, as authenticated attackers can disrupt or manipulate task execution in unauthorized projects, potentially affecting data pipelines and workflows.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
CVE-2026-66087: Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint
CVE-2026-66087 is an authorization bypass vulnerability in Apache DolphinScheduler before version 3.4.3 that allows authenticated users to stop or create savepoints for task instances in projects they lack access to. The flaw affects two application programming interface (API) endpoints that fail to properly validate project authorization before permitting task operations.
Why it matters: Organizations running Apache DolphinScheduler before 3.4.3 need to upgrade immediately, as authenticated attackers can disrupt workflows and alter task state across projects they should not access, impacting workflow orchestration and data pipeline integrity.
- Source published
- First seen by Cybersecurity Tracker