CVE-2026-78214: Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths
An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a remote unauthenticated attacker can cause the security check to fail to recognize the request as targeting a protected endpoint.
As a result, the attacker may bypass authentication and access otherwise restricted Actuator endpoints. Successful exploitation may expose operational or configuration information and, depending on the enabled endpoints and application configuration, allow access to sensitive management functionality.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache DolphinSchedulerto a version that resolves this vulnerability.Fixed in 3.4.3
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker does not need to authenticate. Exploitation requires sending a specially crafted request with a percent-encoded path to an affected Apache DolphinScheduler instance.
Which deployments are affected?
Apache DolphinScheduler versions before 3.4.3 are affected. Exposure depends on whether Actuator endpoints are reachable and which management endpoints are enabled in the application configuration.
What could an attacker access after bypassing authentication?
An attacker may access otherwise restricted Actuator endpoints, potentially exposing operational or configuration information. Depending on enabled endpoints and configuration, sensitive management functionality may also be accessible.
How should this be remediated?
Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the issue.