CVE-2026-66084: Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint.
The endpoint fails to verify that the task definition identified by code belongs to the project specified by projectCode. An authenticated user can supply the code of a project they are authorized to access together with a task definition code from another project, bypassing project access restrictions and modifying the target task definition and its upstream dependencies.
This vulnerability can compromise workflow integrity and disrupt task execution in unauthorized projects.This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache DolphinSchedulerto a version that resolves this vulnerability.Fixed in 3.4.3
Event History
Frequently Asked Questions
Which Apache DolphinScheduler versions are affected?
Apache DolphinScheduler versions before 3.4.3 are affected. Version 3.4.3 fixes the issue.
What level of access does an attacker need?
An attacker must be authenticated and must have access to at least one project. They can use that authorized project code together with a task definition code belonging to a different project.
What is the practical impact of exploitation?
An authenticated attacker can modify task definitions and upstream dependencies in projects they are not authorized to access. This can compromise workflow integrity and disrupt task execution in those projects.
What should teams do if they identify an affected deployment?
Upgrade Apache DolphinScheduler to version 3.4.3. The provided information does not describe an alternative workaround.