EUVD-2026-37584Severity by source
Network-accessible API requires valid credentials (PR:L); impact is read-only access to alert instance data (C:L), with no integrity or availability impact.
Lifecycle Timeline
2Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Incorrect authorization in Apache DolphinScheduler before 3.4.2 allows authenticated users to read alert instances belonging to alert groups outside their assigned permissions. The API component (org.apache.dolphinscheduler:dolphinscheduler-api) fails to enforce permission boundaries between alert groups and their associated alert instances, constituting a broken access control flaw. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be an authenticated user of the Apache DolphinScheduler instance - no public exploit or unauthenticated path is identified. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor rates this vulnerability as moderate, which is consistent with an independent assessment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated DolphinScheduler user with access only to alert group A queries the API endpoint for alert instances and, by manipulating resource identifiers, retrieves alert instance records associated with alert group B - a group to which they have no assigned permissions. This could expose sensitive data such as notification webhook URLs, email addresses, or credentials configured in alert plugins belonging to other teams or administrative groups. |
| Remediation | The primary fix is to upgrade Apache DolphinScheduler to version 3.4.2 or later, as confirmed by the Apache project advisory at https://dolphinscheduler.apache.org and the oss-security disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all DolphinScheduler deployments and versions in use; restrict network access to alert management API endpoints via firewall or WAF. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today