What is the CVSS score of EUVD-2026-94807?

EUVD-2026-94807 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache DolphinScheduler are affected by EUVD-2026-94807?

Apache DolphinScheduler deployments running any release prior to 3.4.3 allow any authenticated user to stop or create savepoints on task instances in projects they are not authorized to access,…. A patch is available.

How to fix or mitigate EUVD-2026-94807?

Within 24 hours, inventory all Apache DolphinScheduler instances and confirm which run a version earlier than 3.4.3, identify the accounts holding authenticated access, and enable or preserve audit logging on the /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop and /savepoint endpoints so any unauthorized stop or savepoint activity is captured. Within 7 days, upgrade every affected instance to Apache DolphinScheduler 3.4.3 or later, and where the upgrade cannot be completed in that window, temporarily restrict network reachability to the DolphinScheduler API to trusted networks, reduce the number of authenticated accounts with task-instance permissions, and monitor for abnormal task termination or savepoint events. Within 30 days, verify post-upgrade that cross-project stop and savepoint calls are rejected, review logs from the pre-upgrade period for evidence of abuse, rotate credentials for any account suspected of misuse, and document the version baseline so future installations are provisioned at 3.4.3 or above.

Apache DolphinScheduler EUVD-2026-94807

| CVE-2026-66087 HIGH

Incorrect Authorization (CWE-863)

2026-10-08

GHSA-8x8j-rj29-7qph

Authentication Bypass Apache

8.1

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.1 HIGH

Authenticated user (PR:L) remotely abuses cross-project task controls, so integrity is high and stopping tasks adds low availability impact; the stop/savepoint endpoints disclose no data, hence C:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Oct 08, 2026 - 21:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Oct 08, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Oct 08, 2026 - 21:22 NVD

8.1 (HIGH)

Patch available

Oct 08, 2026 - 10:01 EUVD

Analysis Generated

Oct 08, 2026 - 02:17 vuln.today

CVE Published

Oct 08, 2026 - 01:58 oss-security

CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Authorization Bypass in Apache DolphinScheduler - CVE-2026-66087 Oct 08, 2026

AnalysisAI

Authenticated users of Apache DolphinScheduler can stop or create savepoints for task instances belonging to projects they are not authorized to access, because the project-scoped task-instance API fails to enforce per-project authorization. The issue affects all releases before 3.4.3 and is reachable over the network via the /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop and /savepoint endpoints. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires a valid authenticated DolphinScheduler account (PR:L) with network access to the web API; it is NOT exploitable by anonymous/unauthenticated attackers. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine but moderate-priority issue, not a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: 3.4.3 - upgrade Apache DolphinScheduler to 3.4.3 or later, which contains the authorization fix for the project-scoped task-instance endpoints; the vendor explicitly recommends this upgrade, and details are in the oss-sec advisory at https://seclists.org/oss-sec/2026/q4/95 and on https://dolphinscheduler.apache.org. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Apache DolphinScheduler instances and confirm which run a version earlier than 3.4.3, identify the accounts holding authenticated access, and enable or preserve audit logging on the /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop and /savepoint endpoints so any unauthorized stop or savepoint activity is captured. …

Threat intelligence, references, and detailed analysis are available after sign-in.