EUVD-2026-37583
GHSA-85g9-8j9g-p486
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-accessible API requiring authenticated low-privilege account (PR:L); authorization bypass enables high-integrity impact via unauthorized write operations; confidentiality impact assessed as low since read operations may also be exposed.
Primary rating from Vendor (CNA).
CVSS VectorCISA-ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
2Blast Radius
ecosystem impact- 1 maven packages depend on org.apache.dolphinscheduler:dolphinscheduler-api (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 3.4.2.
Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Incorrect Authorization in Apache DolphinScheduler's experimental /v2 API interface permits authenticated users to invoke privileged operations without undergoing permission validation. All releases of the dolphinscheduler-api module prior to 3.4.2 are affected. An attacker with a valid account can bypass role-based access controls enforced on the stable API surface by routing requests through the unguarded /v2 endpoint, potentially performing administrative workflow, datasource, or tenant operations beyond their granted privilege level. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Apache DolphinScheduler is an Apache Software Foundation open-source distributed workflow scheduling platform, packaged as org.apache.dolphinscheduler:dolphinscheduler-api. The platform exposes a REST API through which users manage DAG-based workflows, datasources, tenants, and cluster resources. The /v2 path was introduced as an experimental, next-generation API version alongside the stable /v1 interface. The root cause is a missing or bypassed authorization interceptor on the /v2 route prefix - the standard Spring-based permission check middleware that enforces role-based access control (RBAC) on /v1 endpoints was not applied to the /v2 handlers. This maps to CWE-863 (Incorrect Authorization) - the system authenticates the requester but fails to verify whether that requester holds the required permission for the requested resource or action. The affected Maven artifact is org.apache.dolphinscheduler:dolphinscheduler-api in versions before 3.4.2.
RemediationAI
The primary remediation is to upgrade to Apache DolphinScheduler version 3.4.2, which introduces proper authorization checks on the /v2 API interface per the vendor's own recommendation. The fix version (3.4.2) is confirmed by the vendor advisory. If an immediate upgrade is not feasible, a compensating control is to block or restrict access to /v2/* URL paths at the reverse proxy or API gateway layer (e.g., Nginx deny directive or WAF rule targeting the /v2 path prefix) - this prevents exploitation but also disables the experimental interface entirely for all users, which is an acceptable trade-off given its experimental status. Additionally, network-level access controls should restrict the DolphinScheduler API port to only trusted internal networks or VPN-connected clients, reducing the attacker pool to already-authenticated insiders. Vendor advisory: https://dolphinscheduler.apache.org; oss-security thread: https://seclists.org/oss-sec/2026/q2/954.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today