CVE-2026-66082

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions prior to 3.4.3

Description An authorization bypass allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances across different projects. The system verifies permissions against the provided projectCode but does not confirm if the target resource actually belongs to that project. Consequently, a user with permissions in one project can use that project's code alongside a resource identifier from another project to bypass access restrictions. This allows attackers to alter workflow availability and interfere with task execution in unauthorized projects via the following endpoints:

Recommendations Upgrade to version 3.4.3.