CVE-2026-47340: Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.
Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.dolphinscheduler:dolphinscheduler-apito a version that resolves this vulnerability.Fixed in 3.4.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47340?
The severity of CVE-2026-47340 is medium with a CVSS score of 6.5.
What does CVE-2026-47340 vulnerability involve?
CVE-2026-47340 involves an incorrect authorization vulnerability allowing authenticated users to access alert instances they shouldn't have permission to see.
How do I fix CVE-2026-47340?
To fix CVE-2026-47340, it is recommended to upgrade Apache DolphinScheduler to version 3.4.2 or later.
Who is affected by CVE-2026-47340?
CVE-2026-47340 affects users of Apache DolphinScheduler versions prior to 3.4.2.
What type of vulnerability is CVE-2026-47340 classified as?
CVE-2026-47340 is classified as an information leak vulnerability.