EUVD-2026-88814
GHSA-xhgf-wr45-fhhj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Authenticated (PR:L) network user bypasses project authorization with no user interaction; impact is moderate and bounded by the target workflow's capabilities, so C/I/A:L.
Primary rating from Vendor (apache).
CVSS VectorVendor: apache
Lifecycle Timeline
3DescriptionCVE.org
An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task.
The system does not properly verify whether the user has permission to execute the referenced workflow or access its project. As a result, the user can bypass project-level authorization controls and cause workflows in unauthorized projects to be executed.
Successful exploitation may allow unauthorized execution of workflow tasks and access to the resources or data available to the target workflow.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
AnalysisAI
Improper authorization in Apache DolphinScheduler's sub-workflow task handling allows an authenticated user who lacks access to a given project to reference and execute a workflow owned by that project, bypassing project-level access controls. Only deployments using project boundaries as a security boundary (multi-tenant or multi-team instances) are meaningfully exposed, and exploitation requires a low-privileged authenticated account able to create workflows and sub-workflow tasks (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L); no victim interaction is required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated DolphinScheduler account with the ability to create workflows/sub-workflow tasks, but WITHOUT permission to the target project. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS, EPSS, KEV, or SSVC data is provided, so risk must be inferred from the description and the CWE-862 (missing authorization) pattern. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Apache DolphinScheduler 3.4.3, the version named in the advisory as fixing the sub-workflow authorization flaw (https://lists.apache.org/thread.html/2dlzoz0vd5onovxxmylmgb2lvrsj0ot6); there is no vendor-supplied backport for earlier release lines in the provided data, so environments on 3.4.2 and below must move to 3.4.3 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Apache Dolphinscheduler
View allUnauthenticated remote disclosure of database credentials and other sensitive configuration data in Apache DolphinSchedu
Information disclosure in Apache DolphinScheduler before 3.4.3 allows any authenticated user to call the /datasources/un
Information disclosure in Apache DolphinScheduler 3.2.0 through versions before 3.4.3 lets any authenticated low-privile
Unsafe deserialization in Apache DolphinScheduler RPC module (versions 3.2.0 to 3.3.0) allows authenticated network atta
Authentication bypass in Apache DolphinScheduler before 3.4.3 allows remote unauthenticated attackers to reach protected
Improper authorization in Apache DolphinScheduler before 3.4.3 allows an authenticated user to copy or move workflow def
Incorrect authorization in Apache DolphinScheduler before 3.4.3 allows an authenticated user who holds only read permiss
Missing project-level authorization in the Task Group APIs of Apache DolphinScheduler allows an authenticated user to re
Authenticated shell command injection in Apache DolphinScheduler (all versions before 3.4.3) lets a user with permission
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today