Medium severity · published Jun 17, 2026
CVE-2026-41280
Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects
4.9
CVSS
0.4%
EPSS
No
On KEV
Description
Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects
This issue affects Apache DolphinScheduler versions prior to 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Apache DolphinScheduler · Apache Software Foundation
before 3.4.2 · source: vendor
DO
Dolphinscheduler · Apache
before 3.4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41280
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41280
Mailing List
https://lists.apache.org/thread/5bv1njp3lbbbj11y20td5yz1b4nmrtvw
Mailing List
http://www.openwall.com/lists/oss-security/2026/06/17/7
More from Apache DolphinScheduler
9.8
CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
9.1
CVE-2026-32967
Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks
8.8
CVE-2026-82804
Apache DolphinScheduler: Command Injection in the Alert Script Plugin
8.8
CVE-2026-49050
Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens
8.1
CVE-2026-66087
Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint