CVE-2026-93737

Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution time...

CVE-2026-93737 Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet

Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution time...

CVE-2026-93737

Azkaban through 4.0.0 contains an authorization bypass in the ScheduleServlet fetchSchedule action , which omits project permission checks. An authenticated user can supply arbitrary project and flow identifiers to retrieve sensitive schedule details of any project, including execution times, cro...

CVE-2026-93737 Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet

Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution time...

CVE-2026-93737 Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet

Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution time...

EUVD-2026-83027

Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution time...

CVE-2026-93737: Missing Authorization

Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution time...

PT-2026-95484

Name of the Vulnerable Software and Affected Versions Azkaban versions prior to 4.0.1 Description An authorization bypass exists in the fetchSchedule action of the ScheduleServlet endpoint. Authenticated users can retrieve schedule configurations for any project by providing arbitrary project and...

Azkaban Web Client Detection

An Azkaban web client panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """An Azkaban web client panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Azkaban Web Client Detection',...

ai.databand.azkaban:azkaban-web-server (3.18.0), com.alibaba:dubbo (>=2.0.10, <=2.6.0) +141 more potentially affected by CVE-2026-47065 via org.apache.mina:mina-core (1.1.7)

org.apache.mina:mina-core MAVEN version 1.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.mina:mina-core and may be impacted: - ai.databand.azkaban:azkaban-web-server 3.18.0 - com.alibaba:dubbo =2.0.10, =2.6.1, =3.0.0.rc1, =3.0.0.rc1,...

CVE-2020-10992

Azkaban through 3.84.0 allows XXE, related to validator/XmlValidatorManager.java and user/XmlUserManager.java...

EUVD-2020-3390

Malware in sbrugna...

aendter.jenkins.plugins:filesystem-list-parameter-plugin (>=0.0.1, <=0.0.6), ai.databand.azkaban:azkaban-common (3.18.0) +15826 more potentially affected by CVE-2025-48976 via commons-fileupload:commons-fileupload (>=1.0, <=1.5)

commons-fileupload:commons-fileupload MAVEN version =1.0, =0.0.1, =0.5.0, =0.6.0, =0.5.0, =0.8.4, =0.8.4, =0.9.1, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.8.4, =0.9.0 and more Source cves: CVE-2025-48976 Source advisory: OSV:GHSA-VV7R-C36W-3PRJ...

MAL-2024-1797 Malicious code in @ozon-ob/azkaban (npm)

--- -= Per source details. Do not edit below this line.=-...

ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1105 more potentially affected by CVE-2023-34396 via org.apache.struts:struts-core (>=1.3.5, <=1.3.10)

org.apache.struts:struts-core MAVEN version =1.3.5, =9.1.1, =2.0.0, =1.2.1, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.0.0, =1.1.0 - cn.zhucongqi:e7du-jfinal 1.0.0 and more Source cves: CVE-2023-34396 Source advisory: OSV:GHSA-4G42-GQRG-4633...

ai.databand.azkaban:azkaban-common (3.18.0), ai.databand.azkaban:azkaban-exec-server (3.18.0) +2798 more potentially affected by CVE-2022-1471 via org.yaml:snakeyaml (1.18)

org.yaml:snakeyaml MAVEN version 1.18 is affected by a known vulnerability. The following packages have a transitive dependency on org.yaml:snakeyaml and may be impacted: - ai.databand.azkaban:azkaban-common 3.18.0 - ai.databand.azkaban:azkaban-exec-server 3.18.0 -...

ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1105 more potentially affected by CVE-2015-0899 via org.apache.struts:struts-core (>=1.3.5, <=1.3.10)

org.apache.struts:struts-core MAVEN version =1.3.5, =9.1.1, =2.0.0, =1.2.1, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.0.0, =1.1.0 - cn.zhucongqi:e7du-jfinal 1.0.0 and more Source cves: CVE-2015-0899 Source advisory: GHSA-CVVX-R33M-V7PQ...

ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1105 more potentially affected by CVE-2016-1181 via org.apache.struts:struts-core (>=1.3.5, <=1.3.10)

org.apache.struts:struts-core MAVEN version =1.3.5, =9.1.1, =2.0.0, =1.2.1, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.0.0, =1.1.0 - cn.zhucongqi:e7du-jfinal 1.0.0 and more Source cves: CVE-2016-1181 Source advisory: OSV:GHSA-7JW3-5Q4W-89QG...

ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1105 more potentially affected by CVE-2016-1182 via org.apache.struts:struts-core (>=1.3.5, <=1.3.10)

org.apache.struts:struts-core MAVEN version =1.3.5, =9.1.1, =2.0.0, =1.2.1, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.0.0, =1.1.0 - cn.zhucongqi:e7du-jfinal 1.0.0 and more Source cves: CVE-2016-1182 Source advisory: OSV:GHSA-5GGR-MPGW-3MGX...

ai.databand.azkaban:azkaban-web-server (3.18.0), at.ganzleicht.vaadin:vaadin-maven-plugin (>=9.1.1, <=9.1.3.2) +1105 more potentially affected by CVE-2016-1182 via org.apache.struts:struts-core (>=1.3.5, <=1.3.10)

org.apache.struts:struts-core MAVEN version =1.3.5, =9.1.1, =2.0.0, =1.2.1, =0.1, =2.1-beta1, =1.2.1, =1.0.0, =0.0.1.alpha, =0.0.1.alpha, =1.2.28, =1.0.0, =1.0.0, =1.1.0 - cn.zhucongqi:e7du-jfinal 1.0.0 and more Source cves: CVE-2016-1182 Source advisory: GHSA-5GGR-MPGW-3MGX...