https://seclists.org/oss-sec/2026/q3/996: CVE-2026-78214: Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths

Q: Who can exploit this issue?

A remote attacker does not need to authenticate. Exploitation requires sending a specially crafted request with a percent-encoded path to the affected API component.

Q: Which deployments are affected?

Apache DolphinScheduler installations using org.apache.dolphinscheduler:dolphinscheduler-api before version 3.4.3 are affected. The practical impact depends on which Actuator endpoints are enabled and how the application is configured.

Q: What could an attacker access?

An attacker may access Actuator endpoints that would normally require authentication. This can expose operational or configuration information and may provide access to sensitive management functionality when such endpoints are enabled.

Q: What is the recommended remediation?

Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the authentication-bypass issue.

Published Sep 29, 2026

Updated

Affected Software

1 affected component

Apache Dolphinscheduler<3.4.3

Frequently Asked Questions

Who can exploit this issue?

A remote attacker does not need to authenticate. Exploitation requires sending a specially crafted request with a percent-encoded path to the affected API component.

Which deployments are affected?

Apache DolphinScheduler installations using org.apache.dolphinscheduler:dolphinscheduler-api before version 3.4.3 are affected. The practical impact depends on which Actuator endpoints are enabled and how the application is configured.

What could an attacker access?

An attacker may access Actuator endpoints that would normally require authentication. This can expose operational or configuration information and may provide access to sensitive management functionality when such endpoints are enabled.

What is the recommended remediation?

Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the authentication-bypass issue.