CVE-2026-41280
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects.
Risk Assessment
The organization may be exposed to unauthorized deletion of important task definitions, potentially disrupting system operations.
Recommendation
It is recommended to upgrade to version 3.4.2, which fixes this issue.
Other vulnerabilities in Apache DolphinScheduler
See all- CVE-2026-32967Critical
Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects versions before 3.4.2.
- CVE-2026-32966Critical
Missing authorization check in DataSource API leads to arbitrary data source metadata disclosure in Apache DolphinScheduler.
- CVE-2026-49050High
In Apache DolphinScheduler before 3.4.2, a general user can mint admin access tokens via /access-tokens. Users are recommended to upgrade to version 3.4.2, which fixes the issue.
- CVE-2026-47340Medium
In Apache DolphinScheduler before version 3.4.2, authenticated users can access alert instances associated with alert groups they do not have permission to access.
- CVE-2026-42357Medium
The Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
Original NVD description (English source)
Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue.