AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

dolphinschedulerGHSA-72mv-wwvm-vgp5

Apache DolphinScheduler has an Incorrect Authorization Vulnerability

dolphinscheduler

CVE-2026-23902 · Published Apr 24, 2026 · updated May 5, 2026

High8.1
Fix: upgrade to 3.4.1 or later
GitHub advisory

Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.

This issue affects Apache DolphinScheduler versions prior to 3.4.1. 

Users are recommended to upgrade to version 3.4.1, which fixes this issue.

Affected versions

PackageAffectedFixed in
org.apache.dolphinscheduler:dolphinscheduler
Maven
< 3.4.13.4.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-863
Also known as
CVE-2026-23902

More dolphinscheduler advisories

All dolphinscheduler
Medium 6.3Apr 24Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerabilityCVE-2025-62233fixed in 3.3.1High 7.5Apr 9Apache DolphinScheduler vulnerable to sensitive information disclosureCVE-2025-62188fixed in 3.2.0High 8.8Sep 9, 2025Apache DolphinScheduler vulnerable to Alert Script AttackCVE-2024-43115fixed in 3.2.2LowSep 3, 2025Apache DolphinScheduler Incorrect Default Permissions VulnerabilityCVE-2024-43166fixed in 3.3.1High 8.1Aug 12, 2024Apache DolphinScheduler: Resource File Read And Write VulnerabilityCVE-2024-30188fixed in 3.2.2High 8.8Aug 12, 2024Apache DolphinScheduler: RCE by arbitrary js executionCVE-2024-29831fixed in 3.2.2