High severity · published Apr 24, 2026
CVE-2026-23902
Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.
8.1
CVSS
0.4%
EPSS
No
On KEV
Description
Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.
This issue affects Apache DolphinScheduler versions prior to 3.4.1.
Users are recommended to upgrade to version 3.4.1, which fixes this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Apache DolphinScheduler · Apache Software Foundation
before 3.4.1 · source: vendor
DO
Dolphinscheduler · Apache
before 3.4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23902
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23902
Mailing List
https://lists.apache.org/thread/hy4ntb2gys8150zfmnxhsd5ph0hoh7s9
Mailing List
http://www.openwall.com/lists/oss-security/2026/04/24/1
More from Apache DolphinScheduler
9.8
CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
9.1
CVE-2026-32967
Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks
8.8
CVE-2026-82804
Apache DolphinScheduler: Command Injection in the Alert Script Plugin
8.8
CVE-2026-49050
Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens
8.1
CVE-2026-66087
Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint