https://seclists.org/oss-sec/2026/q4/94: CVE-2026-66084: Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstam Endpoint

Q: Who can exploit this issue?

An attacker must be authenticated and have access to at least one project. They can use an authorized project code together with a task definition code belonging to a different project.

Q: What can an attacker change through the vulnerable endpoint?

The attacker can modify the target task definition and its upstream dependencies in a project they are not authorized to access. This can compromise workflow integrity and disrupt task execution.

Q: Which deployments are affected?

Apache DolphinScheduler versions before 3.4.3 are affected. The provided information does not identify any configuration prerequisite beyond authenticated access.

Q: What should teams do to remediate the issue?

Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the authorization check.

Published Oct 8, 2026

Updated

Affected Software

1 affected component

Apache Dolphinscheduler<3.4.3

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated and have access to at least one project. They can use an authorized project code together with a task definition code belonging to a different project.

What can an attacker change through the vulnerable endpoint?

The attacker can modify the target task definition and its upstream dependencies in a project they are not authorized to access. This can compromise workflow integrity and disrupt task execution.

Which deployments are affected?

Apache DolphinScheduler versions before 3.4.3 are affected. The provided information does not identify any configuration prerequisite beyond authenticated access.

What should teams do to remediate the issue?

Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the authorization check.