anonhaven

CVE-2026-66087

NONE EPSS 0.16%
Updated Oct 08, 2026
Apache Software Foundation
Parameter Value
Affected Versions before 3.4.3.
Fixed In 3.4.3
Type CWE-863 (Incorrect Authorization)
Vendor Apache Software Foundation
Public PoC No

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the  * /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop * /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Weakness Type (CWE)

CWE-863 Incorrect Authorization

Vulnerable Products

apache software foundation:apache dolphinscheduler

References 2

https://lists.apache.org/thread.html/pghhb42sbyv5dhx6clcj4hllxnh7c0dn
security@apache.org
http://www.openwall.com/lists/oss-security/2026/10/08/3
af854a3a-2127-422b-91ae-364da2661108
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-71896

Apache Software Foundation

6.5

CVE-2026-71895

Apache Software Foundation

7.1

CVE-2026-71183

Apache Software Foundation

7.1

CVE-2026-92415

Apache Software Foundation

6.9

CVE-2026-92414

Apache Software Foundation

9.3