As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-66082: Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）
Apache DolphinScheduler versions before 3.4.3 contain an authorization bypass vulnerability in their application programming interface (API) that allows authenticated users to access and modify workflow schedules, definitions, and task instances across project boundaries. The flaw stems from insufficient verification that target resources belong to the project specified in the request, despite permission checks against the supplied project code.
Why it matters: Organizations running DolphinScheduler must upgrade to version 3.4.3 or later immediately, as authenticated attackers can escalate privileges within the system to manipulate workflows and schedules in projects they do not own.
- Source published
- First seen by Cybersecurity Tracker