https://seclists.org/oss-sec/2026/q3/994: CVE-2026-71898: Apache DolphinScheduler: Improper Authorization Allows Project ad-Only Users to Execute Workflows and Tamper with Workflow Definitions

Q: Who can exploit this issue?

An authenticated Apache DolphinScheduler user who has read-only permission for a project can exploit the affected endpoint. The issue is limited to workflow instances in projects for which that user has read permission.

Q: What access does an attacker need?

The attacker needs valid authentication and read permission for the target project. They can then send a PUT request to /projects/{projectCode}/workflow-instances/{id} without having the write permission normally required for workflow-instance modification.

Q: Which deployments are affected?

Apache DolphinScheduler versions before 3.4.3 are affected. Version 3.4.3 fixes the authorization check.

Q: How can teams determine whether unauthorized modification may have occurred?

Review requests to the PUT /projects/{projectCode}/workflow-instances/{id} endpoint and compare the requesting users' project permissions with the changes made. Read-only project users making successful modification requests are indicative of exposure.

Published Sep 29, 2026

Updated

Affected Software

1 affected component

Apache Dolphinscheduler<3.4.3

Frequently Asked Questions

Who can exploit this issue?

An authenticated Apache DolphinScheduler user who has read-only permission for a project can exploit the affected endpoint. The issue is limited to workflow instances in projects for which that user has read permission.

What access does an attacker need?

The attacker needs valid authentication and read permission for the target project. They can then send a PUT request to /projects/{projectCode}/workflow-instances/{id} without having the write permission normally required for workflow-instance modification.

Which deployments are affected?

Apache DolphinScheduler versions before 3.4.3 are affected. Version 3.4.3 fixes the authorization check.

How can teams determine whether unauthorized modification may have occurred?

Review requests to the PUT /projects/{projectCode}/workflow-instances/{id} endpoint and compare the requesting users' project permissions with the changes made. Read-only project users making successful modification requests are indicative of exposure.