EUVD-2026-37583

🗓️ 17 Jun 2026 18:35:48Reported by EUVDType

Incorrect authorization on DolphinScheduler /v2 interface; affected before 3.4.2; upgrade to 3.4.2.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2026-32967	17 Jun 202602:13	–	circl
CVE	CVE-2026-32967	17 Jun 202608:57	–	cve
Cvelist	CVE-2026-32967 Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks	17 Jun 202608:57	–	cvelist
Github Security Blog	Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks	17 Jun 202618:35	–	github
NVD	CVE-2026-32967	17 Jun 202613:20	–	nvd
OSV	GHSA-85G9-8J9G-P486 Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks	17 Jun 202618:35	–	osv
Positive Technologies	PT-2026-50260	17 Jun 202600:00	–	ptsecurity
Snyk	Incorrect Authorization	17 Jun 202610:20	–	snyk
Veracode	Improper Authorization	25 Jun 202605:18	–	veracode
vulnersOsv	org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.3.2 <=3.4.1), org.apache.dolphinscheduler:dolphinscheduler-standalone-server (>=3.0.0 <=3.0.6) potentially affected by CVE-2026-32967 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.0.0-alpha <=3.4.1)	17 Jun 202610:20	–	vulnersosv

[
  {
    "enisaIdVendor": [
      {
        "id": "fdc08897-62bf-32b0-868a-ff8e4b5f2d4f",
        "vendor": {
          "name": "Apache Software Foundation"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "5b3166f7-d1f8-3173-a60f-13cd3ee593de",
        "product": {
          "name": "Apache DolphinScheduler",
          "vendor": {
            "name": "Apache Software Foundation"
          }
        },
        "product_version": "0 <3.4.2"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/5o5jrg1snkmrto96wg015wgbh7hyckzc
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-32967
openwall	www.openwall.com/lists/oss-security/2026/06/17/3

17 Jun 2026 18:35Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.16.5 - 9.1

EPSS0.00337

SSVC