Moderate severityNVD Advisory· Published Jun 17, 2026
Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
CVE-2026-42357
Description
Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
This issue affects Apache DolphinScheduler versions prior to 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.dolphinscheduler:dolphinscheduler-apiMaven | < 3.4.2 | 3.4.2 |
Affected products
1- Range: <3.4.2
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-wv7f-c794-82v6ghsaADVISORY
- lists.apache.org/thread/74l2rrz32w2chn7vz64313gk7ox5wjtrghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-42357ghsaADVISORY
- www.openwall.com/lists/oss-security/2026/06/17/4ghsaWEB
News mentions
1- Apache: Seven CVEs Across Shiro, DolphinScheduler, and Airflow Disclosed June 17Vypr Intelligence · Jun 17, 2026