Medium severity · published Jun 17, 2026
CVE-2026-47340
Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Apache DolphinScheduler · Apache Software Foundation
before 3.4.2 · source: vendor
DO
Dolphinscheduler · Apache
before 3.4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-47340
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-47340
Mailing List
https://lists.apache.org/thread/gx6v1wjb6qg3fzksxomysspy2gw54ooc
Mailing List
http://www.openwall.com/lists/oss-security/2026/06/17/5
More from Apache DolphinScheduler
9.8
CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
9.1
CVE-2026-32967
Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks
8.8
CVE-2026-82804
Apache DolphinScheduler: Command Injection in the Alert Script Plugin
8.8
CVE-2026-49050
Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens
8.1
CVE-2026-66087
Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint