Executive brief
Apache DolphinScheduler, a platform for managing complex data workflows, contains a security flaw where users can view workflow details they are not authorized to see. This could allow an internal user to access sensitive project information or operational data belonging to other teams. Organizations should upgrade to version 3.4.2 to ensure proper data isolation between projects.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the Apache DolphinScheduler API. The root cause is a failure to properly validate project-level permissions when a user requests workflow instance information. An attacker with low-privileged network access can exploit this to bypass intended access controls and view sensitive workflow data belonging to other projects. The vulnerability is addressed in version 3.4.2 by implementing stricter authorization checks on the affected API endpoints.
Affected products
- Apache DolphinScheduler < 3.4.2
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory
- 2026-06-17: patched: Version 3.4.2 released