CVE-2026-66087: Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the
/dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache DolphinSchedulerto a version that resolves this vulnerability.Fixed in 3.4.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be an authenticated Apache DolphinScheduler user. The issue allows that user to operate task instances in projects they are not authorized to access.
Which operations are affected?
The affected task-instance operations are stop and savepoint, exposed through the project task-instance stop and savepoint endpoints.
Are default deployments affected?
The available information does not identify any configuration prerequisite beyond having an authenticated user and a vulnerable DolphinScheduler version. Apache DolphinScheduler versions before 3.4.3 are affected.
What should teams do to remediate the issue?
Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the authorization bypass.