Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.
This issue affects Apache DolphinScheduler versions prior to 3.4.1.
Users are recommended to upgrade to version 3.4.1, which fixes this issue.
This issue affects Apache DolphinScheduler versions prior to 3.4.1.
Users are recommended to upgrade to version 3.4.1, which fixes this issue.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 24 Apr 2026 12:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Fri, 24 Apr 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution. This issue affects Apache DolphinScheduler versions prior to 3.4.1. Users are recommended to upgrade to version 3.4.1, which fixes this issue. | |
| Title | Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution. | |
| Weaknesses | CWE-863 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: apache
Published:
Updated: 2026-04-24T11:28:42.712Z
Reserved: 2026-01-18T04:07:20.514Z
Link: CVE-2026-23902
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-04-24T12:17:06.453
Modified: 2026-04-24T14:39:28.770
Link: CVE-2026-23902
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses