https://seclists.org/oss-sec/2026/q4/93: CVE-2026-66082: Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）

Q: Which users can exploit this issue?

An attacker must be authenticated and have the required permissions in at least one project. They can then use that project's projectCode with a resource identifier from a different project to bypass the other project's access restrictions.

Q: What cross-project actions are possible?

The listed endpoints allow an affected user to activate or deactivate workflow schedules in another project and change workflow definitions between ONLINE and OFFLINE states. This can alter workflow availability and interfere with task execution.

Q: How can I determine whether my deployment is affected?

Apache DolphinScheduler versions before 3.4.3 are affected. Deployments running 3.4.3 or later are not identified as affected by this advisory.

Q: What is the recommended remediation?

Upgrade Apache DolphinScheduler to version 3.4.3 or later.

Published Oct 8, 2026

Updated

Affected Software

1 affected component

Apache Dolphinscheduler<3.4.3

Frequently Asked Questions

Which users can exploit this issue?

An attacker must be authenticated and have the required permissions in at least one project. They can then use that project's projectCode with a resource identifier from a different project to bypass the other project's access restrictions.

What cross-project actions are possible?

The listed endpoints allow an affected user to activate or deactivate workflow schedules in another project and change workflow definitions between ONLINE and OFFLINE states. This can alter workflow availability and interfere with task execution.

How can I determine whether my deployment is affected?

Apache DolphinScheduler versions before 3.4.3 are affected. Deployments running 3.4.3 or later are not identified as affected by this advisory.

What is the recommended remediation?

Upgrade Apache DolphinScheduler to version 3.4.3 or later.