Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-32967 EUVD-2026-37583GHSA-85g9-8j9g-p486

Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks

Published Jun 17, 2026 · Updated Aug 21, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache DolphinScheduler Package: org.apache.dolphinscheduler:dolphinscheduler-api Ecosystem: Maven

Description

Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler.

This issue affects Apache DolphinScheduler: before 3.4.2.

Users are recommended to upgrade to version 3.4.2, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache DolphinScheduler < 3.4.2 3.4.2

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.dolphinscheduler:dolphinscheduler-api < 3.4.2 3.4.2 GHSA-85g9-8j9g-p486

References