PT-2026-107872 · Apache · Dolphinscheduler

H1Ei1

+3

·

CVE-2026-66087

·

Published

2026-10-08

·

Updated

2026-10-08

CVSS v3.1

8.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions prior to 3.4.3
Description An authorization bypass allows authenticated users to operate task instances in projects they are not authorized to access. This occurs through the following API endpoints:
  • '/dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop'
  • '/dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint'
Recommendations Upgrade to version 3.4.3.

Fix

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-66087

Affected Products

Dolphinscheduler