https://seclists.org/oss-sec/2026/q3/918: CVE-2026-57590: Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations

Q: Who can exploit this issue?

An authenticated user can exploit it if they can invoke the affected Task Group APIs. The flaw is that those APIs do not verify the user's permission for the project associated with the target Task Group.

Q: What is the impact of successful exploitation?

An authenticated user may perform Task Group operations across projects without authorization. The provided information does not specify which individual Task Group operations are exposed.

Q: Which deployments are affected?

Apache DolphinScheduler versions before 3.4.3 are affected. Version 3.4.3 fixes the authorization issue.

Published Sep 24, 2026

Updated

Affected Software

1 affected component

Apache Dolphinscheduler<3.4.3

Frequently Asked Questions

Who can exploit this issue?

An authenticated user can exploit it if they can invoke the affected Task Group APIs. The flaw is that those APIs do not verify the user's permission for the project associated with the target Task Group.

What is the impact of successful exploitation?

An authenticated user may perform Task Group operations across projects without authorization. The provided information does not specify which individual Task Group operations are exposed.

Which deployments are affected?

Apache DolphinScheduler versions before 3.4.3 are affected. Version 3.4.3 fixes the authorization issue.