What is the CVSS score of CVE-2026-42357?

CVE-2026-42357 has a CVSS 3.1 base score of 6.5 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache DolphinScheduler are affected by CVE-2026-42357?

Apache DolphinScheduler versions prior to 3.4.2 contain a critical authorization flaw that allows authenticated users to access workflow instance data across unintended project boundaries.. A patch is available.

How to fix or mitigate CVE-2026-42357?

Within 24 hours: Identify production deployments of DolphinScheduler and assess the sensitivity of workflow data managed within project isolation boundaries. Within 7 days: Apply vendor-released patch upgrading org.apache.dolphinscheduler:dolphinscheduler-api to version 3.4.2 across all production environments. Within 30 days: Review authentication logs for unauthorized cross-project workflow data access and validate that project isolation controls function as intended post-patch.

Apache DolphinScheduler CVE-2026-42357

EUVD-2026-37582 CRITICAL

Incorrect Authorization (CWE-863)

2026-06-17

Apache Information Disclosure

6.5

CVSS 3.1 · CISA-ADP

Severity by source

Vendor (CNA) PRIMARY

MEDIUM

qualitative

CISA-ADP

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible API flaw requiring a valid authenticated account (PR:L) with impact limited to partial confidentiality exposure of workflow metadata only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorCISA-ADP

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 17, 2026 - 11:01 EUVD

Analysis Generated

Jun 17, 2026 - 02:19 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on org.apache.dolphinscheduler:dolphinscheduler-api (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.4.2.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Incorrect Authorization in Apache DolphinScheduler API - CVE-2026-42357 Jun 18, 2026

AnalysisAI

Incorrect Authorization in Apache DolphinScheduler's API layer exposes workflow instance data across project boundaries to authenticated users who lack the required project permissions. All versions prior to 3.4.2 of the org.apache.dolphinscheduler:dolphinscheduler-api component are affected, with the vendor recommending immediate upgrade to 3.4.2. No public exploit has been identified and the vulnerability is not listed in CISA KEV; real-world risk is concentrated in multi-tenant deployments where project isolation is the primary access control boundary.

Technical ContextAI

Apache DolphinScheduler is an open-source distributed workflow scheduling and orchestration platform, with the API surface exposed through the Maven artifact org.apache.dolphinscheduler:dolphinscheduler-api. The root cause aligns with CWE-863 (Incorrect Authorization), a class of flaw where the system fails to correctly enforce its own access-control policy at the resource level - in this case, failing to validate that the requesting user is a member of, or has been explicitly granted access to, the project that owns the queried workflow instance. The API returns workflow instance records without adequately cross-checking project-level permissions, allowing cross-project enumeration within a shared DolphinScheduler cluster. No CPE string or CWE identifier was formally provided in the source data; the CWE classification here is independently assessed from the description.

RemediationAI

Upgrade Apache DolphinScheduler to version 3.4.2, which contains the authorization fix as confirmed by the Apache security team in the oss-security disclosure (https://seclists.org/oss-sec/2026/q2/955). If an immediate upgrade is operationally infeasible, restrict API access to the DolphinScheduler web interface and REST endpoints to trusted internal network segments only, reducing the pool of users who could abuse the flaw to those already within the organization's perimeter. Additionally, audit active user accounts and remove or deactivate any accounts with unexpectedly broad platform access - reducing the number of accounts capable of querying cross-project workflow data limits lateral exposure. Review API access logs for anomalous cross-project workflow instance requests to identify any prior unauthorized access. No formal vendor-specified workaround exists beyond upgrading to 3.4.2.