CVE-2026-57590

Published: Sep 24, 2026Modified: Sep 24, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://lists.apache.org/thread/3ncvptkjw9h6s8mjxlwwo30bxxgol6ry

Source: security@apache.org

http://www.openwall.com/lists/oss-security/2026/09/24/3

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.