Medium severity6.5NVD Advisory· Published Jun 17, 2026· Updated Jun 17, 2026
CVE-2026-42357
CVE-2026-42357
Description
Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
This issue affects Apache DolphinScheduler versions prior to 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.dolphinscheduler:dolphinscheduler-apiMaven | < 3.4.2 | 3.4.2 |
Affected products
2cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*range: <3.4.2
- (no CPE)range: <3.4.2
Patches
Vulnerability mechanics
References
4- www.openwall.com/lists/oss-security/2026/06/17/4nvdMailing ListThird Party AdvisoryWEB
- github.com/advisories/GHSA-wv7f-c794-82v6ghsaADVISORY
- lists.apache.org/thread/74l2rrz32w2chn7vz64313gk7ox5wjtrnvdMailing ListVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-42357ghsaADVISORY
News mentions
1- Apache: Seven CVEs Across Shiro, DolphinScheduler, and Airflow Disclosed June 17Vypr Intelligence · Jun 17, 2026