CVE-2026-42357
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive project data, potentially leading to privacy breaches and information security issues.
Recommendation
Users are recommended to upgrade to version 3.4.2, which fixes this issue.
Other vulnerabilities in Apache DolphinScheduler
See all- CVE-2026-32967Critical
Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects versions before 3.4.2.
- CVE-2026-32966Critical
Missing authorization check in DataSource API leads to arbitrary data source metadata disclosure in Apache DolphinScheduler.
- CVE-2026-49050High
In Apache DolphinScheduler before 3.4.2, a general user can mint admin access tokens via /access-tokens. Users are recommended to upgrade to version 3.4.2, which fixes the issue.
- CVE-2026-47340Medium
In Apache DolphinScheduler before version 3.4.2, authenticated users can access alert instances associated with alert groups they do not have permission to access.
- CVE-2026-41280Medium
The Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects.
Original NVD description (English source)
Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue.