Moderate severityNVD Advisory· Published Jun 17, 2026
Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects
CVE-2026-41280
Description
Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects
This issue affects Apache DolphinScheduler versions prior to 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.dolphinscheduler:dolphinscheduler-apiMaven | < 3.4.2 | 3.4.2 |
Affected products
1- Range: <3.4.2
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-wh3w-v6gj-fqh2ghsaADVISORY
- lists.apache.org/thread/5bv1njp3lbbbj11y20td5yz1b4nmrtvwghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-41280ghsaADVISORY
- www.openwall.com/lists/oss-security/2026/06/17/7ghsaWEB
News mentions
1- Apache: Seven CVEs Across Shiro, DolphinScheduler, and Airflow Disclosed June 17Vypr Intelligence · Jun 17, 2026