CVE-2026-71899

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions 3.2.0 through 3.4.2

Description A missing authorization issue exists in the query-dynamic-sub-workflows API. The API fails to properly verify if an authenticated user has the necessary permissions to access the workflows being queried. Consequently, an authenticated user can invoke the API using parameters that reference workflows from a project they are not authorized to access, leading to unauthorized disclosure of workflow information.

Recommendations Upgrade to version 3.4.3.