CVE-2026-23902

Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution. This issue affects Apache DolphinScheduler versions prior to 3.4.1. Users are recommended to upgrade to version 3.4.1, which fixes this issue.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/hy4ntb2gys8150zfmnxhsd5ph0hoh7s9	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/24/1	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) La vulnerabilidad de autorización incorrecta en Apache DolphinScheduler permite a usuarios autenticados con permisos de inicio de sesión del sistema utilizar inquilinos que no están definidos en la plataforma durante la ejecución del flujo de trabajo. Este problema afecta a las versiones de Apache DolphinScheduler anteriores a la 3.4.1. Se recomienda a los usuarios actualizar a la versión 3.4.1, que corrige este problema.

Information

Published : 2026-04-24 12:17

Updated : 2026-10-26 21:10

NVD link : CVE-2026-23902

Mitre link : CVE-2026-23902

CVE.ORG link : CVE-2026-23902

JSON object : View

Products Affected

apache

dolphinscheduler

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-23902", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23902", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-24T18:25:12.669237Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache DolphinScheduler", "versions": [{"status": "affected", "version": "0", "lessThan": "3.4.1", "versionType": "semver"}], "packageName": "org.apache.dolphinscheduler:dolphinscheduler-api", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}]}], "published": "2026-04-24T12:17:06.453", "references": [{"url": "https://lists.apache.org/thread/hy4ntb2gys8150zfmnxhsd5ph0hoh7s9", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/24/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.\n\nThis issue affects Apache DolphinScheduler versions prior to 3.4.1.\u00a0\n\nUsers are recommended to upgrade to version 3.4.1, which fixes this issue."}, {"lang": "es", "value": "La vulnerabilidad de autorizaci\u00f3n incorrecta en Apache DolphinScheduler permite a usuarios autenticados con permisos de inicio de sesi\u00f3n del sistema utilizar inquilinos que no est\u00e1n definidos en la plataforma durante la ejecuci\u00f3n del flujo de trabajo.\n\nEste problema afecta a las versiones de Apache DolphinScheduler anteriores a la 3.4.1.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 3.4.1, que corrige este problema."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD2DFC41-4AAE-4940-A40C-94421F0024DC", "versionEndExcluding": "3.4.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}