What is the CVSS score of EUVD-2026-94806?

EUVD-2026-94806 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache DolphinScheduler are affected by EUVD-2026-94806?

A privilege-checking flaw in Apache DolphinScheduler (all versions before 3.4.3) allows someone who already holds a legitimate account in one project to silently rewrite the workflow definitions and…. A patch is available.

How to fix or mitigate EUVD-2026-94806?

Within 24 hours, inventory every Apache DolphinScheduler instance, record its version, and flag any environment where multiple project teams share one deployment; where an immediate upgrade is not possible, restrict network access to the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint and review recent task-definition and upstream-dependency change history for edits originating from users outside the owning project. Within 7 days, deploy the vendor-released patch, Apache DolphinScheduler 3.4.3, to all non-production instances first, validate the upgrade against a restored copy of your workflow definitions, and audit project-level role assignments so users cannot hold task codes that legitimately reference other projects. Within 30 days, complete the 3.4.3 rollout across all production environments, decommission or isolate any deployment still running a version below 3.4.3, and enable alerting on cross-project task-definition and dependency modifications so this class of authorization gap is detected automatically rather than discovered after the fact.

Apache DolphinScheduler EUVD-2026-94806

| CVE-2026-66084 HIGH

Incorrect Authorization (CWE-863)

2026-10-08

GHSA-26vh-p5jc-q2mg

Authentication Bypass Apache Dolphinscheduler

8.1

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.1 HIGH

Network endpoint reachable by any authenticated user (AV:N/AC:L/PR:L); high integrity impact from unauthorized task modification; availability low from disrupted execution; confidentiality unsupported by the description despite vendor C:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 21:40 vuln.today

tag: Dolphinscheduler added

Analysis Updated

Oct 08, 2026 - 21:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Oct 08, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Oct 08, 2026 - 21:22 NVD

8.1 (HIGH)

Patch available

Oct 08, 2026 - 10:01 EUVD

Analysis Generated

Oct 08, 2026 - 02:17 vuln.today

CVE Published

Oct 08, 2026 - 01:56 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Authorization bypass in Apache DolphinScheduler before 3.4.3 allows an authenticated user to alter task definitions, together with their upstream dependencies, in projects they are not authorized to access. The attacker pairs a projectCode they legitimately belong to with a task-definition code belonging to a different project when calling the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint, because the handler never confirms that the task code actually belongs to the supplied project. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid authenticated DolphinScheduler account with access to at least one project (PR:L); it is not exploitable by anonymous/unauthenticated attackers. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine but moderate-priority issue rather than an urgent emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade to Apache DolphinScheduler 3.4.3, which fixes the missing project-ownership check (see https://seclists.org/oss-sec/2026/q4/94 and https://dolphinscheduler.apache.org). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory every Apache DolphinScheduler instance, record its version, and flag any environment where multiple project teams share one deployment; where an immediate upgrade is not possible, restrict network access to the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint and review recent task-definition and upstream-dependency change history for edits originating from users outside the owning project. …

Threat intelligence, references, and detailed analysis are available after sign-in.