Apache DolphinScheduler: Authorization bypass in task definition with-upstream endpoint
Summary
An authenticated user of Apache DolphinScheduler can modify task definitions and their upstream dependencies in projects they are not authorized to access. The REST endpoint /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream does not verify that the task definition belongs to the project given in the URL. An attacker needs a valid account with access to at least one project, so the risk depends on who holds accounts on the instance. The impact is on workflow integrity and task execution rather than direct data disclosure.
Affected
- Apache DolphinScheduler before 3.4.3
- Third-party feeds list narrower ranges (for example 3.4.0 to 3.4.2); the vendor text covers all versions below 3.4.3.
Fixed in
- Upgrade to Apache DolphinScheduler 3.4.3 or later.
Workaround
Unknown.
- Restrict project-level access to the minimum required.
- Limit access to the API to the internal network or VPN.
Exploitation
- No evidence of exploitation in the wild found at the time of writing.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public exploit or CISA KEV entry known.
Our recommendation
- Check whether DolphinScheduler is deployed, which version runs, and whether it is reachable from the internet.
- Upgrade to version 3.4.3 or later; this also covers the related Apache advisories from the same batch.
- Review user accounts and project permissions and remove unneeded access.
- Review recent task-definition changes and upstream dependencies for unexpected edits.
- Back up workflow definitions before patching.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache mailing list advisory (lists.apache.org) lists.apache.org
- Openwall oss-security post CVE-2026-66084 www.openwall.com
- Apache dev mailing list advisory (msg03866) www.mail-archive.com
- PSIRT CVE-2026-66084 psirt.com
- HOL Guard CVE-2026-66084 hol.org
- Vulners RAPID7 CVE-2026-66084 vulners.com
- DolphinScheduler 3.4.3 release notes (newreleases.io) newreleases.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:33.
Original description (NVD)
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint. The endpoint fails to verify that the task definition identified by code belongs to the project specified by projectCode. An authenticated user can supply the code of a project they are authorized to access together with a task definition code from another project, bypassing project access restrictions and modifying the target task definition and its upstream dependencies. This vulnerability can compromise workflow integrity and disrupt task execution in unauthorized projects.This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.