Skip to content
OpenAdvisories
High · 8.8 CVE-2026-49050 EUVD-2026-65391GHSA-9pwm-6667-rfcm

Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens

Published Aug 25, 2026 · Updated Aug 25, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache DolphinScheduler

Description

General user can mint admin access tokens via /access-tokens

This issue affects Apache DolphinScheduler: before 3.4.2.

Users are recommended to upgrade to version 3.4.2, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache DolphinScheduler < 3.4.2 3.4.2

References