GHSA-8x8j-rj29-7qphHighCVSS 8.1

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to...

Published
October 8, 2026
Last Modified
October 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-66087 →

📋 Description

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the 

  • /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop
  • /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint

This issue affects Apache DolphinScheduler: before 3.4.3.

Users are recommended to upgrade to version 3.4.3, which fixes the issue.

🔗 References (4)