GitHub Advisoryadvisory · Maven

GHSA-wv7f-c794-82v6 Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.

MEDIUM Published 2026-06-17 Modified 2026-06-18 Official page ↗
Aliases
CVE-2026-42357
Ecosystem
Maven
Packages
org.apache.dolphinscheduler:dolphinscheduler-api
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-863
Reviewed
2026-06-18

Affected packages

• Maven org.apache.dolphinscheduler:dolphinscheduler-api: < 3.4.2 → fixed in 3.4.2

Description

Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2026-42357 Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References