CVE Tracker

CVE-2026-66087

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task i…

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the * /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop * /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Vendor

Unknown

Product

Unknown

CVSS 3.1

8.1 (high), scored by 134c704f-9b21-4f2e-91b3-4a467353bcc0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-863

Published

2026-10-08

NVD modified

2026-10-08

NVD status

Deferred

Not in the CISA KEV catalogue at the last update.

Data last updated 15 Oct 2026. Sources: NVD API 2.0. Links: NVD, CISA KEV. Metadata only. ThreatWire does not host exploit code.