CVE-2026-23902CWE-863

Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.

High · published April 24, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
37.8
In the wild
Unconfirmed
What it is

Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.

This issue affects Apache DolphinScheduler versions prior to 3.4.1.

Users are recommended to upgrade to version 3.4.1, which fixes this issue.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00446 · 37.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-04-24T10:56Z
EPSS history
Timeline
  • 24 APR 10:56Z
    Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.
    cvelistv5