CVE-2026-66087

Summary

Apache DolphinScheduler contains an authorization bypass vulnerability that allows authenticated users to stop or create savepoints for task instances in projects they don't have access to. This flaw enables unauthorized operations on critical workflow components, potentially leading to data corruption or process disruption.

Exploitability

The exploit is relatively straightforward as it requires only authenticated access and knowledge of target project codes and task instance IDs; no special privileges or complex conditions are needed beyond basic user authentication.

Blast radius

If exploited, this vulnerability could allow attackers to halt critical workflows or create unintended savepoints in projects they shouldn't control, potentially causing operational disruptions across multiple teams' workflows.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache DolphinScheduler 3.4.3 which fixes the authorization bypass issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.