Medium severity4.9NVD Advisory· Published Jun 17, 2026· Updated Jun 17, 2026
CVE-2026-41280
CVE-2026-41280
Description
Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects
This issue affects Apache DolphinScheduler versions prior to 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.dolphinscheduler:dolphinscheduler-apiMaven | < 3.4.2 | 3.4.2 |
Affected products
2<3.4.2+ 1 more
- (no CPE)range: <3.4.2
- cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*range: <3.4.2
Patches
Vulnerability mechanics
References
4- www.openwall.com/lists/oss-security/2026/06/17/7nvdMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-wh3w-v6gj-fqh2ghsaADVISORY
- lists.apache.org/thread/5bv1njp3lbbbj11y20td5yz1b4nmrtvwnvdMailing ListVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-41280ghsaADVISORY
News mentions
1- Apache: Seven CVEs Across Shiro, DolphinScheduler, and Airflow Disclosed June 17Vypr Intelligence · Jun 17, 2026