EUVD-2026-85825
GHSA-qpqm-x4vh-jm23
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable, low-complexity, needs a low-priv authenticated account (PR:L); impact limited to cross-project task-group config read/modify, so C:L/I:L not H, A:N.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
6DescriptionCVE.org
A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
AnalysisAI
Missing project-level authorization in the Task Group APIs of Apache DolphinScheduler allows an authenticated user to read and modify Task Groups that belong to projects they do not have permission to access. Every release before 3.4.3 is affected; the vendor has fixed the flaw in 3.4.3. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated DolphinScheduler account (PR:L) reachable over the network; the attacker must invoke the Task Group APIs against a Task Group belonging to a project they lack permission for. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority authorization flaw, not a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Apache DolphinScheduler 3.4.3, which contains the corrected project-scoped authorization check for the Task Group APIs (advisory: https://lists.apache.org/thread/3ncvptkjw9h6s8mjxlwwo30bxxgol6ry). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache DolphinScheduler instances, confirm which are multi-tenant or multi-project, and verify whether any run a version earlier than 3.4.3; where an upgrade cannot be scheduled immediately, restrict network reachability of the Task Group API endpoints to trusted administrative networks and review account provisioning for unnecessary multi-project access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Dolphinscheduler
View allUnauthenticated remote disclosure of database credentials and other sensitive configuration data in Apache DolphinSchedu
Information disclosure in Apache DolphinScheduler before 3.4.3 allows any authenticated user to call the /datasources/un
Information disclosure in Apache DolphinScheduler 3.2.0 through versions before 3.4.3 lets any authenticated low-privile
Unsafe deserialization in Apache DolphinScheduler RPC module (versions 3.2.0 to 3.3.0) allows authenticated network atta
Authentication bypass in Apache DolphinScheduler before 3.4.3 allows remote unauthenticated attackers to reach protected
Improper authorization in Apache DolphinScheduler before 3.4.3 allows an authenticated user to copy or move workflow def
Incorrect authorization in Apache DolphinScheduler before 3.4.3 allows an authenticated user who holds only read permiss
Improper authorization in Apache DolphinScheduler's sub-workflow task handling allows an authenticated user who lacks ac
Authenticated shell command injection in Apache DolphinScheduler (all versions before 3.4.3) lets a user with permission
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today