CVE-2026-66084 Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-definition/code/with-upstream endpoint. The endpoint fails to verify that th...

CVE-2026-66084

Apache DolphinScheduler versions before 3.4.3 are vulnerable to an authorization bypass via the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint. The application fails to verify if the task definition code belongs to the specified project code. Consequently, ...