CVE-2026-66084

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions prior to 3.4.3

Description An authorization bypass allows authenticated users to modify task definitions in projects they are not authorized to access. The issue occurs at the '/dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream' endpoint, which fails to verify if the task definition identified by code belongs to the project specified by projectCode. An attacker can provide a projectCode they are authorized to access alongside a code from a different project to bypass restrictions and modify the target task definition and its upstream dependencies. Approximately 152,700 instances are identified globally. This flaw can compromise workflow integrity and disrupt task execution.

Recommendations Upgrade to version 3.4.3.