CVE-2026-57590CWE-863broken-access-control

CVE-2026-57590

High · published September 24, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
12.9
In the wild
Unconfirmed
What it is

A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group.

This issue affects Apache DolphinScheduler: before 3.4.3.

Users are recommended to upgrade to version 3.4.3, which fixes the issue.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00229 · 12.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-24T14:17Z
References (2)
https://lists.apache.org/thread/3ncvptkjw9h6s8mjxlwwo30bxxgol6ry · [email protected]http://www.openwall.com/lists/oss-security/2026/09/24/3 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 25 SEP 03:26Z
    EPSS moved — → 0%
    epss
  • 24 SEP 09:13Z
    Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations
    cvelistv5