Apache Software Foundation Apache Dolphinscheduler vulnerabilities

CVE-2026-32967 [CRITICAL] CWE-863 CVE-2026-32967: Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. T Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

CVE-2026-47340 [MEDIUM] CWE-200 CVE-2026-47340: Allow authenticated users to access alert instances associated with alert groups they do not have pe Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

CVE-2026-42357 [MEDIUM] CWE-863 CVE-2026-42357: Incorrect Authorization vulnerability allows users to access workflow instance information belonging Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue.

CVE-2026-41280 [MEDIUM] CWE-863 CVE-2026-41280: Incorrect Authorization vulnerability allows users with system login privileges to delete task defin Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue.