CVE-2026-93737: Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet
Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution times, cron expressions, flow parameters, and notification email lists without proper authorization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Azkabanto a version that resolves this vulnerability.Fixed in 4.0.0 - Configuration
Ensure fetchSchedule in ScheduleServlet enforces project permission checks so authenticated users cannot retrieve schedule configuration (execution times, cron expressions, flow parameters, and notification email lists) for projects they are not authorized to access.
Azkaban ScheduleServlet (fetchSchedule) project permission checks = required
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Azkaban user can exploit it. The attacker needs the target project and flow identifiers and can submit them to the ScheduleServlet fetchSchedule action.
What information can be exposed?
An attacker can read schedule configuration for projects they are not authorized to access, including execution times, cron expressions, flow parameters, and notification email lists.
Is user interaction or elevated privilege required?
No user interaction is required, and administrative privileges are not required. The issue requires only an authenticated user account.
How can I determine whether my deployment is affected?
Deployments of Azkaban through version 4.0.0 are affected. Review whether authenticated users can invoke the ScheduleServlet fetchSchedule action with arbitrary project and flow identifiers and receive schedule data for projects they do not have permission to access.