EUVD-2026-94805
GHSA-r995-5488-jh52
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-exposed REST API (AV:N) exploitable by any authenticated low-privilege project user (PR:L) with no interaction; no data read (C:N), but cross-project state tampering gives I:L/A:L.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
4Description PRE-NVD
AnalysisAI
Cross-project authorization bypass in Apache DolphinScheduler before 3.4.3 lets an authenticated user who holds legitimate schedule or workflow permissions in one project reach into a different project and manipulate its resources, because the affected API endpoints validate the caller's rights against the projectCode in the URL but never confirm that the schedule id, workflow definition code, or task instance actually belongs to that project. In practice an attacker can take workflow schedules online or offline and flip workflow definitions between ONLINE and OFFLINE, disrupting scheduled execution and task processing in tenants they were never granted access to. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated DolphinScheduler account that already holds schedule/workflow permissions in at least one project; the attacker then supplies that authorized project's code together with a resource identifier (schedule id, workflow definition code, or task instance) belonging to a different project. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity, authorization-bypass (IDOR-class / CWE-862-style missing authorization) flaw in Apache DolphinScheduler, and the available signals point to a real-but-bounded risk rather than a drop-everything emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Apache DolphinScheduler to 3.4.3, which fixes the issue per the vendor at https://dolphinscheduler.apache.org and the advisory thread at https://seclists.org/oss-sec/2026/q4/93. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm which DolphinScheduler instances are internet- or partner-exposed and at what version, inventory every account holding schedule or workflow permissions, and review API audit logs for projectCode values that do not match the schedule id, workflow definition code, or task instance being modified; block external access to the schedule and workflow-definition APIs at the reverse proxy for anyone outside the trusted operator group. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today