PT-2026-107872

CVE-2026-66087

Published

2026-10-08

Updated

2026-10-08

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions prior to 3.4.3

Description An authorization bypass allows authenticated users to operate task instances in projects they are not authorized to access. This occurs through the following API endpoints:

'/dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop'
'/dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint'

Recommendations Upgrade to version 3.4.3.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration