Executive brief
Apache DolphinScheduler is a workflow orchestration platform used to manage and schedule complex data processing tasks. A security flaw in the system's authorization logic allows logged-in users to delete task definitions in projects they are not supposed to access. This could lead to the accidental or malicious removal of critical business workflows, disrupting data operations.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the Apache DolphinScheduler API. The root cause is a failure to properly validate project-level permissions when a user attempts to delete task definitions. An attacker must have valid system login credentials (high privileges required) to exploit this over the network. Successful exploitation allows the attacker to bypass intended access controls and delete task definitions within projects they do not own or have permissions for. The issue is resolved in version 3.4.2.
Affected products
- Apache DolphinScheduler < 3.4.2
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory
- 2026-06-17: patched: Version 3.4.2 released