CVE-2026-81569

Apache DolphinScheduler versions before 3.4.3 are affected by an improper authorization vulnerability in the handling of sub-workflow tasks . The system fails to verify if an authenticated user has the necessary permissions to access a target project or execute a referenced workflow within that p...

CVE-2026-81569 Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution

An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task. The system does not properly verify whethe...