What is the CVSS score of CVE-2026-49050?

CVE-2026-49050 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Apache DolphinScheduler are affected by CVE-2026-49050?

Apache DolphinScheduler versions prior to 3.4.2 contain an authorization bypass enabling authenticated users to escalate to full administrative privileges and gain unrestricted control over all…. A patch is available.

How to fix or mitigate CVE-2026-49050?

Within 24 hours, identify all Apache DolphinScheduler deployments and determine which are running versions before 3.4.2. Within 7 days, upgrade all affected instances to version 3.4.2 or later per vendor advisory, and review access token audit logs for suspicious token generation by non-administrative accounts. Within 30 days, conduct a full audit of administrative actions for unauthorized escalation attempts, implement restrictive role-based access controls to limit API token generation to verified administrators only, and enforce least-privilege access policies across all user accounts.

Apache DolphinScheduler CVE-2026-49050

EUVD-2026-65391 HIGH

Incorrect Authorization (CWE-863)

2026-06-17

GHSA-9pwm-6667-rfcm

Authentication Bypass Apache Dolphinscheduler

8.8

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Requires a valid general user account (PR:L); API endpoint is network-accessible (AV:N, AC:L); admin token grants complete confidentiality, integrity, and availability impact over the platform.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 25, 2026 - 15:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 25, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

Aug 25, 2026 - 15:22 NVD

8.8 (HIGH)

Patch available

Aug 25, 2026 - 12:01 EUVD

Analysis Generated

Jun 17, 2026 - 02:18 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Privilege Escalation in Apache DolphinScheduler - CVE-2026-49050 Jun 17, 2026

AnalysisAI

Privilege escalation in Apache DolphinScheduler before 3.4.2 allows any authenticated general user to generate admin-level access tokens via the /access-tokens API endpoint, entirely bypassing authorization controls. This CWE-863 (Incorrect Authorization) flaw means that an attacker holding only a basic user account can silently elevate to full administrative control over all workflows, tasks, and sensitive pipeline data on the platform. No public exploit code or CISA KEV listing has been confirmed at time of analysis, but the near-zero exploitation complexity (AC:L, no user interaction) makes this a high-priority remediation target for any organization running the affected versions.

Technical ContextAI

Apache DolphinScheduler is an open-source distributed workflow task scheduling platform commonly deployed in big data and data engineering environments to orchestrate DAG-based pipelines, often alongside Apache Hadoop, Spark, or Flink stacks. The vulnerability resides in the /access-tokens REST API endpoint, which fails to enforce role-based authorization before minting tokens. Per CWE-863 (Incorrect Authorization), the server correctly authenticates the requesting user but does not verify whether that user holds administrative privileges before issuing a token with admin-level scope. This means the authorization check is absent or improperly scoped at the token-generation layer, not a bypass of the authentication layer itself. All versions from 0 through before 3.4.2 are affected, as confirmed by EUVD-2026-65391 and the Apache OSS Security advisory.

RemediationAI

Upgrade Apache DolphinScheduler to version 3.4.2 or later, which contains the vendor-confirmed authorization fix per the advisory at https://dolphinscheduler.apache.org and the OSS Security disclosure at https://seclists.org/oss-sec/2026/q2/957. If an immediate upgrade is not feasible, restrict access to the /access-tokens API endpoint at the network perimeter or reverse proxy layer - blocking POST requests to this path for non-administrative source IPs or roles reduces exploit exposure, though doing so may disrupt legitimate token management workflows for authorized administrators. Additionally, audit all existing access tokens for unexpected admin-level entries and revoke any that were not created through authorized administrative processes, as tokens minted via this vulnerability persist in the system even after patching and must be explicitly invalidated.