Executive brief
Apache DolphinScheduler is a workflow orchestration platform used to manage complex data processing tasks. A security flaw in its experimental v2 interface allows unauthorized users to bypass permission checks. This could allow an attacker to view or modify sensitive workflow data and system configurations without proper credentials.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the Apache DolphinScheduler API. The `/v2` experimental interface fails to implement necessary permission checks, allowing remote, unauthenticated attackers to interact with the API. By sending specially crafted network requests to this endpoint, an attacker can bypass security controls to access or modify data. The vulnerability is present in versions prior to 3.4.2 and is addressed in the 3.4.2 release.
Affected products
- Apache DolphinScheduler < 3.4.2
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory
- 2026-06-17: patched: Fixed in version 3.4.2