CVE-2026-66087: Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint

Q: Who can exploit this issue?

An attacker must be an authenticated Apache DolphinScheduler user. The issue allows that user to operate task instances in projects they are not authorized to access.

Q: Which operations are affected?

The affected task-instance operations are stop and savepoint, exposed through the project task-instance stop and savepoint endpoints.

Q: Are default deployments affected?

The available information does not identify any configuration prerequisite beyond having an authenticated user and a vulnerable DolphinScheduler version. Apache DolphinScheduler versions before 3.4.3 are affected.

Q: What should teams do to remediate the issue?

Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the authorization bypass.

Published Oct 8, 2026

Updated

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the

/dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint

This issue affects Apache DolphinScheduler: before 3.4.3.

Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Affected Software

1 affected component

Apache Dolphinscheduler<3.4.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache DolphinScheduler to a version that resolves this vulnerability.
Fixed in 3.4.3

Event History

Oct 8, 2026

CVE Published

via MITRE·08:29 AM

Data Sourced

via MITRE·08:29 AM

DescriptionWeakness

Data Sourced

via NVD·09:16 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be an authenticated Apache DolphinScheduler user. The issue allows that user to operate task instances in projects they are not authorized to access.

Which operations are affected?

The affected task-instance operations are stop and savepoint, exposed through the project task-instance stop and savepoint endpoints.

Are default deployments affected?

The available information does not identify any configuration prerequisite beyond having an authenticated user and a vulnerable DolphinScheduler version. Apache DolphinScheduler versions before 3.4.3 are affected.

What should teams do to remediate the issue?

Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the authorization bypass.

CVE-2026-66087: Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which operations are affected?

Are default deployments affected?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which operations are affected?

Are default deployments affected?

What should teams do to remediate the issue?