CVE-2026-42357— Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
Possible ATT&CK Techniques 1AI
T1078 · Valid AccountsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache DolphinScheduler | < 3.4.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-42357
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
Source: NVD (National Vulnerability Database)
Vulnerability Description
Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不正确
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache dolphinscheduler 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache dolphinscheduler是美国Apache基金会开源的一个分布式工作流调度器。 Apache dolphinscheduler 3.4.2之前版本存在授权问题漏洞，该漏洞源于授权不正确，可能导致用户访问其无权限项目的工作流实例信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache DolphinScheduler | 0 ~ 3.4.1 | - |
II. Public POCs for CVE-2026-42357
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-42357
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-42357 (1)
Same Patch Batch · Apache Software Foundation · 2026-06-17 · 7 CVEs total
| CVE-2026-49268 | Apache Shiro: LDAP DN Injection in DefaultLdapRealm | |
| CVE-2026-47340 | Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated use | |
| CVE-2026-32967 | Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks | |
| CVE-2026-41280 | Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system lo | |
| CVE-2026-32966 | Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Dat | |
| CVE-2026-50203 | Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local f |
IV. Related Vulnerabilities
Same product: Apache DolphinScheduler
- CVE-2026-47340
Apache DolphinScheduler: An incorrect authorization vulnerab - CVE-2026-32967
Apache DolphinScheduler: The `/v2` experimental interface la - CVE-2026-41280
Apache DolphinScheduler: Incorrect Authorization vulnerabili - CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorizatio - CVE-2026-23902
Apache DolphinScheduler: Users are able to use tenants that
Same vendor: Apache Software Foundation
- CVE-2026-59173
Apache Traffic Server: DoS vulnerability in HTTP/2 via stall - CVE-2026-62764
Apache Accumulo: A user can trigger a graceful shutdown of s - CVE-2026-26032
Apache Ivy: PackagerResolver path traversal vulnerability - CVE-2026-57821
Apache Fineract: Office list: SQL Injection via Subquery in - CVE-2026-35152
Apache Fineract: SQL injection in runreports endpoint
Same weakness: CWE-863
- CVE-2026-16200
zevorn rt-claw RPC swarm.c claw_tool_invoke authorization - CVE-2026-16195
Sipeed PicoClaw Group Message wecom.go dispatchIncoming auth - CVE-2026-10130
QueryWeaver Authentication Bypass via Email Signup Token Iss - CVE-2026-16126
zevorn rt-claw Swarm RPC Receiver swarm.c handle_rpc_request - CVE-2026-16122
nextlevelbuilder GoClaw exec_approval.go matchesAllowlist au
V. Comments for CVE-2026-42357
No comments yet