CVE-2026-57590: Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations

[Wenjun Ruan <wenjun () apache org>]

Severity: low 

Affected versions:

- Apache DolphinScheduler before 3.4.3

Description:

A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do 
not properly verify whether the authenticated user has permission to access the project associated with the target Task 
Group.



This issue affects Apache DolphinScheduler: before 3.4.3.



Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Credit:

Meng Qingwei (finder)
Thành Nguyễn (finder)
Yeonoh Park (finder)
tonghuaroot (finder)
George Chen (finder)

References:

https://dolphinscheduler.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-57590