CVE-2026-41280: Apache DolphinScheduler incorrect authorization in task deletion

CVE-2026-41280 · Severity: medium · CVSS 4.9 · Published 2026-06-17

Apache DolphinScheduler is a workflow orchestration platform used to manage and schedule complex data processing tasks. A security flaw in the system's authorization logic allows logged-in users to delete task definitions in projects they are not supposed to access. This could lead to the accidental or malicious removal of critical business workflows, disrupting data operations.

Technologies: Apache Software Foundation DolphinScheduler, org.apache.dolphinscheduler:dolphinscheduler-api (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2026-41280 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41280 being exploited in the wild.
How severe is CVE-2026-41280?
Medium severity, with a CVSS score of 4.9, published 17 June 2026.
Which products and versions are affected?
Apache Software Foundation DolphinScheduler < 3.4.2, versions prior to 3.4.2; org.apache.dolphinscheduler:dolphinscheduler-api (Maven) < 3.4.2, ECOSYSTEM:introduced=0,fixed=3.4.2.
Is there a fix for CVE-2026-41280?
Yes. org.apache.dolphinscheduler:dolphinscheduler-api (Maven): upgrade to 3.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41280 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41280?
Check whether you run Apache Software Foundation DolphinScheduler or org.apache.dolphinscheduler:dolphinscheduler-api (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.dolphinscheduler:dolphinscheduler-api (Maven): upgrade to 3.4.2 or later
    # set org.apache.dolphinscheduler:dolphinscheduler-api to 3.4.2 in your pom.xml or build.gradle

Technical details

An incorrect authorization vulnerability (CWE-863) exists in the Apache DolphinScheduler API. The root cause is a failure to properly validate project-level permissions when a user attempts to delete task definitions. An attacker must have valid system login credentials (high privileges required) to exploit this over the network. Successful exploitation allows the attacker to bypass intended access controls and delete task definitions within projects they do not own or have permissions for. The issue is resolved in version 3.4.2.

Affected products

  • Apache DolphinScheduler < 3.4.2

Identifiers

  • CVE-2026-41280
  • GHSA-wh3w-v6gj-fqh2

Timeline

  • 2026-06-17: disclosed
  • 2026-06-17: advisory
  • 2026-06-17: patched: Version 3.4.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.