← Back to the live CVE advisory feed

CVE-2026-66084: Product identification pending

Severity

8.1 (HIGH)

Vendor

APACHE

Affected versions

Before 3.4.3.

Fixed version

3.4.3

Patch status

Patched

Published

2026-10-08T09:16:41.783

Modified

2026-10-08T21:18:01.973

Why it matters

High-severity vulnerability requiring prioritized review.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.

Technical summary

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint. The endpoint fails to verify that the task definition identified by code belongs to the project specified by projectCode. An authenticated user can supply the code of a project they are authorized to access together with a task definition code from another project, bypassing project access restrictions and modifying the target task definition and its upstream dependencies. This vulnerability can compromise workflow integrity and disrupt task execution in unauthorized projects.This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

View the official NVD record for CVE-2026-66084

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.