CVE-2026-71898
Received Received - Intake

Incorrect Authorization Check in Apache DolphinScheduler Allows Workflow Modification

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: Apache Software Foundation

Description
An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/{projectCode}/workflow-instances/{id} endpoint. The endpoint does not enforce the write permission required for this operation, allowing the user to make unauthorized changes to workflow instances. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-71898
EUVD
EUVD-2026-88817

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache dolphinscheduler to 3.4.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an incorrect authorization check in Apache DolphinScheduler. An authenticated user with read-only permissions for a project can modify a workflow instance in that project using a specific API endpoint. The endpoint fails to enforce write permissions, allowing unauthorized changes to workflow instances.

Detection Guidance

To detect this vulnerability, check Apache DolphinScheduler versions before 3.4.3. Run commands like 'curl -X GET http://<server>/actuator/info' or 'curl -X GET http://<server>/dolphinscheduler/version' to verify the installed version. If the version is below 3.4.3, the system is vulnerable.

Impact Analysis

If you use Apache DolphinScheduler versions before 3.4.3, an attacker with read access could alter workflow instances, potentially disrupting operations, causing data corruption, or executing unintended workflows. This could lead to unauthorized modifications in your project workflows.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by allowing unauthorized modifications to workflow instances. Unauthorized changes to data processing workflows may lead to violations of data integrity or confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade Apache DolphinScheduler to version 3.4.3 or later to fix the authorization check issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71898. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart