CVE-2026-57590: Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations
A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache DolphinSchedulerto a version that resolves this vulnerability.Fixed in 3.4.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user is required, because the affected APIs check the user's authentication but fail to verify permission for the project associated with the target Task Group. Such a user may be able to perform Task Group operations across projects they are not authorized to access.
Which deployments are affected?
Apache DolphinScheduler versions before 3.4.3 are affected. The provided information does not identify any configuration prerequisite or mitigation other than upgrading.
What should teams do to remediate the issue?
Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the authorization check. If an immediate upgrade is not possible, the provided information does not specify a supported workaround.