GitHub Advisoryadvisory · Maven

GHSA-72mv-wwvm-vgp5 Apache DolphinScheduler has an Incorrect Authorization Vulnerability

HIGH Published 2026-04-24 Modified 2026-05-05 Official page ↗
Aliases
CVE-2026-23902
Ecosystem
Maven
Packages
org.apache.dolphinscheduler:dolphinscheduler
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-863
Reviewed
2026-05-05

Affected packages

• Maven org.apache.dolphinscheduler:dolphinscheduler: < 3.4.1 → fixed in 3.4.1

Description

Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution. This issue affects Apache DolphinScheduler versions prior to 3.4.1.  Users are recommended to upgrade to version 3.4.1, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2026-23902 Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References