CVE-2026-23902

HIGH8.1

Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.

Published Apr 24, 2026

Modified 1 months ago

Details

Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.

This issue affects Apache DolphinScheduler versions prior to 3.4.1.

Users are recommended to upgrade to version 3.4.1, which fixes this issue.

References

WEB

http://www.openwall.com/lists/oss-security/2026/04/24/1

ADVISORY

https://lists.apache.org/thread/hy4ntb2gys8150zfmnxhsd5ph0hoh7s9

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-23902

CVSS Analysis

CVSS v3.1

8.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

NoneA:N

8.1/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness Type (CWE)

Access Control

CWE-863

Incorrect Authorization

Ecosystems

Timeline

PublishedApr 24, 2026

ModifiedApr 24, 2026

CVE-2026-23902 | Mondoo Vulnerability Intelligence