apache__dolphinscheduler_CVE-2023-51770_3_2_1_fixed

Apache Dolphinscheduler About Apache DolphinScheduler is the modern data orchestration platform. Agile to create high performance workflow with low-code. It is also provided powerful user interface, dedicated to solving complex task dependencies in the data pipeline and providing various types of...

apache__dolphinscheduler_CVE-2023-49109_3-2-0

Apache Dolphinscheduler About Apache DolphinScheduler is a modern data orchestration platform that empowers agile, low-code development of high-performance workflows. It is dedicated to handling complex task dependencies in data pipelines, and provides a wide range of built-in job types out of th...

apache__dolphinscheduler_CVE-2022-26884_2-0-5

Dolphin Scheduler Official Website dolphinscheduler.apache.org Total Lines Design Features DolphinScheduler is a distributed and extensible workflow scheduler platform with powerful DAG visual interfaces, dedicated to solving complex job dependencies in the data pipeline and providing various typ...

apache__dolphinscheduler_CVE-2023-51770_3-2-00

Apache Dolphinscheduler About Apache DolphinScheduler is a modern data orchestration platform that empowers agile, low-code development of high-performance workflows. It is dedicated to handling complex task dependencies in data pipelines, and provides a wide range of built-in job types out of th...

CVE-2026-71899

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...

CVE-2026-81569

An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task. The system does not properly verify whethe...

CVE-2026-78214

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...

CVE-2026-71898

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71897

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. Th...

CVE-2026-82804

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

EUVD-2026-88819

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. Th...

CVE-2026-71897 Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. Th...

CVE-2026-71897

Apache DolphinScheduler versions prior to 3.4.3 are vulnerable to an improper authorization check within the batch-copy and batch-move endpoints. An authenticated user can exploit this flaw to operate on workflows in projects for which they lack the necessary permissions, potentially allowing the...

CVE-2026-71897 Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. Th...

CVE-2026-71898 Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

EUVD-2026-88817

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898 Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898

Apache DolphinScheduler versions before 3.4.3 are vulnerable to an incorrect authorization check that allows an authenticated user with only read permission for a project to modify a workflow instance. By accessing the PUT /projects/{projectCode}/workflow-instances/{id} endpoint, which fails to e...

EUVD-2026-88816

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...

CVE-2026-71899 Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...