Executive brief
Azkaban is a workflow scheduling system used to manage and execute data pipelines. An authentication bypass vulnerability allows any logged-in user to read the schedule configuration of projects they should not have access to, including when jobs run, their parameters, and notification email addresses. This could enable account enumeration, social engineering attacks, or reconnaissance for more serious attacks.
Technical details
The ScheduleServlet fetchSchedule action in Azkaban through version 4.0.0 fails to validate project-level permissions before returning schedule configuration data. An authenticated attacker can supply arbitrary project and flow identifiers via the web API to retrieve sensitive schedule details without authorization checks. The vulnerability requires valid authentication credentials but allows horizontal privilege escalation across projects.
Affected products
- Azkaban Azkaban through 4.0.0
Timeline
- 2026-09-18: disclosed