Which versions of Apache DolphinScheduler are affected by CVE-2026-49050?

Apache DolphinScheduler deployments face a critical privilege escalation vulnerability (CVE-2026-49050) where any authenticated user can obtain full administrator access tokens, effectively seizing…

How to fix or mitigate CVE-2026-49050?

Within 24 hours: Inventory all DolphinScheduler deployments and confirm which systems run versions before 3.4.2. Immediately restrict network access to the /access-tokens API endpoint for non-administrative accounts using WAF, reverse proxy, or network-level controls. Within 7 days: Implement comprehensive logging of all token creation requests and audit logs for suspicious activity; establish baseline of legitimate administrative token requests; enforce role-based API access controls. Within 30 days: Monitor vendor advisories for patch availability (target: DolphinScheduler 3.4.2 or later); develop and test deployment procedures in staging; execute patching within 48 hours of vendor release.

Apache DolphinScheduler CVE-2026-49050

CRITICAL

2026-06-17

Apache Information Disclosure

Severity by source

vuln.today AI

9.9 CRITICAL

Network API endpoint, no complexity, requires only a general user account (PR:L), scope change to admin grants high C/I with limited direct availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 02:18 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Privilege Escalation in Apache DolphinScheduler - CVE-2026-49050 Jun 17, 2026

AnalysisAI

Privilege escalation in Apache DolphinScheduler before 3.4.2 allows any authenticated general user to mint admin-level access tokens by calling the /access-tokens API endpoint directly, bypassing role-enforcement logic. This effectively grants full administrative control over the workflow scheduling platform to any low-privilege account holder. No public exploit has been identified at time of analysis, but the simplicity of the attack surface - a direct API call - makes this a high-priority remediation target for any multi-tenant or enterprise DolphinScheduler deployment.

Technical ContextAI

Apache DolphinScheduler is an open-source distributed workflow scheduling platform (Maven artifact org.apache.dolphinscheduler:dolphinscheduler-api). The /access-tokens endpoint is the API surface for generating personal access tokens used for programmatic API authentication. The vulnerability indicates that the server-side authorization check for this endpoint fails to enforce the caller's role, allowing a user with 'general' privileges to request a token scoped to admin privileges. This is a classic authorization bypass (broken object-level or function-level authorization), consistent with CWE-269 (Improper Privilege Management) or CWE-285 (Improper Authorization). The affected CPE is org.apache.dolphinscheduler:dolphinscheduler-api versions prior to 3.4.2. No CWE was formally assigned in the advisory.

Affected ProductsAI

Apache DolphinScheduler, specifically the dolphinscheduler-api component (org.apache.dolphinscheduler:dolphinscheduler-api), all versions before 3.4.2 are affected. The vendor advisory is available at https://dolphinscheduler.apache.org and the CVE record at https://www.cve.org/CVERecord?id=CVE-2026-49050. No CPE string was formally published, but the Maven coordinates identify the scope precisely.

RemediationAI

The primary fix is to upgrade Apache DolphinScheduler to version 3.4.2, which the vendor confirms resolves this authorization bypass. The advisory is published at https://dolphinscheduler.apache.org. No workarounds are described in the advisory. As a compensating control prior to patching, operators should audit all existing access tokens issued via /access-tokens to identify any general-user-generated tokens with elevated scope, and revoke them. Additionally, network-level access to the DolphinScheduler API should be restricted to trusted internal networks or VPN only, preventing externally-positioned general users from exploiting the endpoint. Note that network restriction alone does not remediate the flaw for insider-threat scenarios.