CVE-2026-47340
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In Apache DolphinScheduler before version 3.4.2, authenticated users can access alert instances associated with alert groups they do not have permission to access.
Risk Assessment
This may lead to unauthorized access to sensitive information within the system, posing a significant security risk to the organization.
Recommendation
It is recommended to upgrade to version 3.4.2, which fixes this issue.
Other vulnerabilities in Apache DolphinScheduler
See all- CVE-2026-32967Critical
Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects versions before 3.4.2.
- CVE-2026-32966Critical
Missing authorization check in DataSource API leads to arbitrary data source metadata disclosure in Apache DolphinScheduler.
- CVE-2026-49050High
In Apache DolphinScheduler before 3.4.2, a general user can mint admin access tokens via /access-tokens. Users are recommended to upgrade to version 3.4.2, which fixes the issue.
- CVE-2026-42357Medium
The Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
- CVE-2026-41280Medium
The Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects.
Original NVD description (English source)
Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.