CVE-2026-23902
Undergoing Analysis Undergoing Analysis - In Progress
BaseFortify

Publication date: 2026-04-24

Last updated on: 2026-04-27

Assigner: Apache Software Foundation

Description
Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution. This issue affects Apache DolphinScheduler versions prior to 3.4.1.  Users are recommended to upgrade to version 3.4.1, which fixes this issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-24
Last Modified
2026-04-27
Generated
2026-05-07
EPSS Evaluated
2026-05-05
NVD
CVE-2026-23902
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
apache dolphinscheduler to 3.4.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart