CVE-2026-49050
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In Apache DolphinScheduler before 3.4.2, a general user can mint admin access tokens via /access-tokens. Users are recommended to upgrade to version 3.4.2, which fixes the issue.
Risk Assessment
The risk is privilege escalation, where a regular user can gain administrator privileges, potentially leading to full compromise of the system and data.
Recommendation
Upgrade Apache DolphinScheduler to version 3.4.2 or later as soon as possible, which includes the fix.
Other vulnerabilities in Apache DolphinScheduler
See all- CVE-2026-32967Critical
Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects versions before 3.4.2.
- CVE-2026-32966Critical
Missing authorization check in DataSource API leads to arbitrary data source metadata disclosure in Apache DolphinScheduler.
- CVE-2026-47340Medium
In Apache DolphinScheduler before version 3.4.2, authenticated users can access alert instances associated with alert groups they do not have permission to access.
- CVE-2026-42357Medium
The Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
- CVE-2026-41280Medium
The Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects.
Original NVD description (English source)
General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.