CVE-2026-57590
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue affects Apache DolphinScheduler before 3.4.3.
Risk Assessment
An unauthorized user may gain access to task groups in projects they are not permitted to access, potentially leading to unauthorized modifications or disclosure of sensitive workflow information.
Recommendation
Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the issue, and review user permissions in existing projects.
Other vulnerabilities in Apache DolphinScheduler
See all- CVE-2026-32967Critical
Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects versions before 3.4.2.
- CVE-2026-32966Critical
Missing authorization check in DataSource API leads to arbitrary data source metadata disclosure in Apache DolphinScheduler.
- CVE-2026-49050High
In Apache DolphinScheduler before 3.4.2, a general user can mint admin access tokens via /access-tokens. Users are recommended to upgrade to version 3.4.2, which fixes the issue.
- CVE-2026-47340Medium
In Apache DolphinScheduler before version 3.4.2, authenticated users can access alert instances associated with alert groups they do not have permission to access.
- CVE-2026-42357Medium
The Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
- CVE-2026-41280Medium
The Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects.
Original NVD description (English source)
A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS