CVE-2026-93737

Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution time...

CVE-2026-93737 Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet

Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution time...

EUVD-2026-83027

Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution time...

CVE-2026-93737

Azkaban through 4.0.0 contains an authorization bypass in the ScheduleServlet fetchSchedule action , which omits project permission checks. An authenticated user can supply arbitrary project and flow identifiers to retrieve sensitive schedule details of any project, including execution times, cro...

CVE-2026-93737 Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet

Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution time...

CVE-2026-93737 Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet

Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution time...

PT-2026-95484

Name of the Vulnerable Software and Affected Versions Azkaban versions prior to 4.0.1 Description An authorization bypass exists in the fetchSchedule action of the ScheduleServlet endpoint. Authenticated users can retrieve schedule configurations for any project by providing arbitrary project and...

CVE-2026-93737: Missing Authorization

Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution time...

ai.databand.azkaban:azkaban-web-server (3.18.0), com.alibaba:dubbo (>=2.0.10, <=2.6.0) +141 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.1.7)

org.apache.mina:mina-core MAVEN version 1.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - ai.databand.azkaban:azkaban-web-server 3.18.0 - com.alibaba:dubbo =2.0.10, =2.6.1, =3.0.0.rc1, =3.0.0.rc1,...

CVE-2020-10992

Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java...

EUVD-2020-3390

Malware in sbrugna...

MAL-2024-1797 Malicious code in @ozon-ob/azkaban (npm)

--- -= Per source details. Do not edit below this line.=-...

ai.databand.azkaban:azkaban-common (3.18.0), ai.databand.azkaban:azkaban-exec-server (3.18.0) +2798 more potentially affected by CVE-2022-1471 via org.yaml:snakeyaml (1.18)

org.yaml:snakeyaml MAVEN version 1.18 is affected by a known vulnerability. The following packages have a transitive dependency on org.yaml:snakeyaml and may be impacted: - ai.databand.azkaban:azkaban-common 3.18.0 - ai.databand.azkaban:azkaban-exec-server 3.18.0 -...

ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1105 more potentially affected by CVE-2015-0899 via org.apache.struts:struts-core (>=1.3.5, <=1.3.10)

org.apache.struts:struts-core MAVEN version =1.3.5, =9.1.1, =2.0.0, =1.2.1, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.0.0, =1.1.0 - cn.zhucongqi:e7du-jfinal 1.0.0 and more Source cves: CVE-2015-0899 Source advisory: GHSA-CVVX-R33M-V7PQ...

ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1105 more potentially affected by CVE-2016-1181 via org.apache.struts:struts-core (>=1.3.5, <=1.3.10)

org.apache.struts:struts-core MAVEN version =1.3.5, =9.1.1, =2.0.0, =1.2.1, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.0.0, =1.1.0 - cn.zhucongqi:e7du-jfinal 1.0.0 and more Source cves: CVE-2016-1181 Source advisory: OSV:GHSA-7JW3-5Q4W-89QG...

ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1105 more potentially affected by CVE-2016-1182 via org.apache.struts:struts-core (>=1.3.5, <=1.3.10)

org.apache.struts:struts-core MAVEN version =1.3.5, =9.1.1, =2.0.0, =1.2.1, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.0.0, =1.1.0 - cn.zhucongqi:e7du-jfinal 1.0.0 and more Source cves: CVE-2016-1182 Source advisory: OSV:GHSA-5GGR-MPGW-3MGX...

ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1105 more potentially affected by CVE-2016-1182 via org.apache.struts:struts-core (>=1.3.5, <=1.3.10)

org.apache.struts:struts-core MAVEN version =1.3.5, =9.1.1, =2.0.0, =1.2.1, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.0.0, =1.1.0 - cn.zhucongqi:e7du-jfinal 1.0.0 and more Source cves: CVE-2016-1182 Source advisory: GHSA-5GGR-MPGW-3MGX...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.databand.azkaban:azkaban-common (3.18.0) +34398 more potentially affected by CVE-2017-18640 via org.yaml:snakeyaml (>=1.4, <=1.25)

org.yaml:snakeyaml MAVEN version =1.4, =4.4.0.0, =0.2, =0.2, =0.2, =0.2, =0.2, =0.2, =0.0.12, =0.1.8, =0.1.6, =0.1.7 and more Source cves: CVE-2017-18640 Source advisory: GHSA-RVWF-54QP-4R6V...

ai.databand.azkaban:azkaban-common (3.18.0), ai.databand.azkaban:azkaban-exec-server (3.18.0) +2457 more potentially affected by CVE-2020-8908 via com.google.guava:guava (13.0.1)

com.google.guava:guava MAVEN version 13.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.guava:guava and may be impacted: - ai.databand.azkaban:azkaban-common 3.18.0 - ai.databand.azkaban:azkaban-exec-server 3.18.0 -...

ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1326 more potentially affected by CVE-2020-13959 via org.apache.velocity:velocity-tools (>=2.0-beta3, <=2.0)

org.apache.velocity:velocity-tools MAVEN version =2.0-beta3, =9.1.1, =1.0.0-alpha-2, =1.0.0, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.1.0 and more Source cves: CVE-2020-13959 Source advisory: OSV:GHSA-FH63-4R66-JC7V...