https://seclists.org/oss-sec/2026/q3/995: CVE-2026-71899: Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosu

Q: Who can exploit this issue?

An authenticated Apache DolphinScheduler user can exploit it, even if that user lacks permission for the project containing the referenced workflows. The issue is limited to access through the query-dynamic-sub-workflows API.

Q: Which deployments are affected?

Apache DolphinScheduler versions from 3.2.0 up to, but not including, 3.4.3 are affected. The provided information does not identify any configuration prerequisite beyond having an authenticated user able to invoke the API.

Q: What information could be exposed?

An unauthorized authenticated user can retrieve workflow information for workflows in projects outside that user's authorized project scope. The provided information does not further specify the workflow fields or data returned.

Q: What is the recommended remediation?

Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the missing authorization check. No temporary mitigation is specified in the provided information.

Published Sep 29, 2026

Updated

Affected Software

1 affected component

Apache Dolphinscheduler>=3.2.0<3.4.3

Frequently Asked Questions

Who can exploit this issue?

An authenticated Apache DolphinScheduler user can exploit it, even if that user lacks permission for the project containing the referenced workflows. The issue is limited to access through the query-dynamic-sub-workflows API.

Which deployments are affected?

Apache DolphinScheduler versions from 3.2.0 up to, but not including, 3.4.3 are affected. The provided information does not identify any configuration prerequisite beyond having an authenticated user able to invoke the API.

What information could be exposed?

An unauthorized authenticated user can retrieve workflow information for workflows in projects outside that user's authorized project scope. The provided information does not further specify the workflow fields or data returned.

What is the recommended remediation?

Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the missing authorization check. No temporary mitigation is specified in the provided information.