Apache DolphinScheduler has an Incorrect Authorization Vulnerability

GHSA-72mv-wwvm-vgp5 · CVE-2026-23902

Published Apr 24, 2026 · Modified May 5, 2026

Description

Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.

This issue affects Apache DolphinScheduler versions prior to 3.4.1.

Users are recommended to upgrade to version 3.4.1, which fixes this issue.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-23902
PACKAGE https://github.com/apache/dolphinscheduler
WEB https://lists.apache.org/thread/hy4ntb2gys8150zfmnxhsd5ph0hoh7s9
WEB http://www.openwall.com/lists/oss-security/2026/04/24/1

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes