GitHub Advisoryadvisory · Maven

GHSA-wh3w-v6gj-fqh2 Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects

MEDIUM Published 2026-06-17 Modified 2026-06-18 Official page ↗
Aliases
CVE-2026-41280
Ecosystem
Maven
Packages
org.apache.dolphinscheduler:dolphinscheduler-api
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-863
Reviewed
2026-06-18

Affected packages

• Maven org.apache.dolphinscheduler:dolphinscheduler-api: < 3.4.2 → fixed in 3.4.2

Description

Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2026-41280 Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References