CVE-2026-66084

Summary

An authorization bypass flaw in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they shouldn't have access to by exploiting a missing validation check on the project-task relationship. This can lead to unauthorized workflow modifications and execution disruptions.

Exploitability

Exploitation is straightforward for authenticated users who know the target project's code and another project's task definition code, requiring no special prerequisites beyond basic access to the affected endpoint.

Blast radius

The vulnerability could allow attackers to silently modify critical workflow definitions in unauthorized projects, potentially causing execution failures or data integrity issues across multiple workflows without detection.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache DolphinScheduler 3.4.3 which fixes the authorization bypass issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.