What is the CVSS score of CVE-2026-47340?

CVE-2026-47340 has a CVSS 3.1 base score of 6.5 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache DolphinScheduler are affected by CVE-2026-47340?

Apache DolphinScheduler contains a critical broken access control vulnerability (CVE-2026-47340) in its alert management API that allows authenticated users to read alert instances outside their…. A patch is available.

How to fix or mitigate CVE-2026-47340?

Within 24 hours: Identify all DolphinScheduler deployments and versions in use; restrict network access to alert management API endpoints via firewall or WAF. Within 7 days: Review API audit logs for unauthorized alert instance access patterns; audit user role assignments and alert group permissions for least-privilege enforcement. Within 30 days: Monitor Apache DolphinScheduler security advisories for patch availability targeting version 3.4.2 or later; develop and test upgrade plan or evaluate alternative workflow orchestration platforms.

Apache DolphinScheduler CVE-2026-47340

EUVD-2026-37584 CRITICAL

Information Exposure (CWE-200)

2026-06-17

Apache Information Disclosure

6.5

CVSS 3.1 · CISA-ADP

Severity by source

Vendor (CNA) PRIMARY

MEDIUM

qualitative

CISA-ADP

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible API requires valid credentials (PR:L); impact is read-only access to alert instance data (C:L), with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorCISA-ADP

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 17, 2026 - 11:01 EUVD

Analysis Generated

Jun 17, 2026 - 02:19 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on org.apache.dolphinscheduler:dolphinscheduler-api (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.4.2.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Incorrect Authorization in Apache DolphinScheduler <3.4.2 - CVE-2026-47340 Jun 17, 2026

AnalysisAI

Incorrect authorization in Apache DolphinScheduler before 3.4.2 allows authenticated users to read alert instances belonging to alert groups outside their assigned permissions. The API component (org.apache.dolphinscheduler:dolphinscheduler-api) fails to enforce permission boundaries between alert groups and their associated alert instances, constituting a broken access control flaw. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the moderate severity rating reflects the authentication prerequisite and limited confidentiality impact.

Technical ContextAI

Apache DolphinScheduler is an open-source distributed workflow scheduling and orchestration platform, primarily consumed as a set of Maven artifacts under the org.apache.dolphinscheduler groupId. The vulnerable component is the API server module (dolphinscheduler-api), which manages resource-level access control across workflow entities including alert groups and their associated alert instances. The root cause is an authorization enforcement gap - consistent with CWE-863 (Incorrect Authorization) - where server-side permission checks on alert instance retrieval endpoints do not validate that the requesting user holds the correct permission for the owning alert group. No CWE was formally assigned in the source data; CWE-863 is inferred from the description. The affected CPE is org.apache.dolphinscheduler:dolphinscheduler-api prior to version 3.4.2.

RemediationAI

The primary fix is to upgrade Apache DolphinScheduler to version 3.4.2 or later, as confirmed by the Apache project advisory at https://dolphinscheduler.apache.org and the oss-security disclosure. This is a vendor-released patch: version 3.4.2. If an immediate upgrade is not feasible, organizations should apply the principle of least privilege by auditing and tightening alert group memberships - ensuring only operationally necessary accounts are granted any alert group permissions, thereby reducing the set of users who could exploit the authorization bypass. Additionally, reviewing API access logs for unexpected queries against alert instance endpoints may reveal prior exploitation attempts. No other specific workarounds were identified in the source data; compensating controls are secondary to patching.