CVE-2026-23902: Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.
Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.
This issue affects Apache DolphinScheduler versions prior to 3.4.1.
Users are recommended to upgrade to version 3.4.1, which fixes this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23902?
The severity of CVE-2026-23902 is classified as a medium-risk vulnerability.
How do I fix CVE-2026-23902?
To fix CVE-2026-23902, update Apache DolphinScheduler to version 3.4.1 or later to address the incorrect authorization issue.
What impact does CVE-2026-23902 have on Apache DolphinScheduler?
CVE-2026-23902 allows authenticated users to execute workflows using undefined tenants, potentially leading to unauthorized access.
Who is affected by CVE-2026-23902?
CVE-2026-23902 affects users of Apache DolphinScheduler versions prior to 3.4.1 who have system login permissions.
Is CVE-2026-23902 a local or remote vulnerability?
CVE-2026-23902 is considered a local vulnerability since it requires authenticated access to the Apache DolphinScheduler platform.