Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-47340 EUVD-2026-37584GHSA-694g-j8pj-cjj5

Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.

Published Jun 17, 2026 · Updated Jun 17, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache DolphinScheduler Package: org.apache.dolphinscheduler:dolphinscheduler-api Ecosystem: Maven

Description

Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler.

This issue affects Apache DolphinScheduler: before 3.4.2.

Users are recommended to upgrade to version 3.4.2, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache DolphinScheduler < 3.4.2 3.4.2

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.dolphinscheduler:dolphinscheduler-api < 3.4.2 3.4.2 GHSA-694g-j8pj-cjj5

References