High severity · published Sep 24, 2026
CVE-2026-57590
Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations
8.1
CVSS
0.2%
EPSS
No
On KEV
Description
A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Apache DolphinScheduler · Apache Software Foundation
before 3.4.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57590
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57590
lists.apache.org
https://lists.apache.org/thread/3ncvptkjw9h6s8mjxlwwo30bxxgol6ry
www.openwall.com
http://www.openwall.com/lists/oss-security/2026/09/24/3
More from Apache DolphinScheduler
9.8
CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
9.1
CVE-2026-32967
Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks
8.8
CVE-2026-82804
Apache DolphinScheduler: Command Injection in the Alert Script Plugin
8.8
CVE-2026-49050
Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens
8.1
CVE-2026-66087
Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint