CVE-2026-78214

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions prior to 3.4.3

Description An authentication bypass exists in the protection of Actuator endpoints. The application verifies if authentication is required by matching the incoming request path against protected Actuator paths. A remote unauthenticated attacker can use a percent-encoded path in a specially crafted request to cause the security check to fail in recognizing the request as targeting a protected endpoint. This allows the attacker to bypass authentication and access restricted Actuator endpoints, potentially exposing operational or configuration information and providing access to sensitive management functionality.

Recommendations Upgrade to version 3.4.3.