Apache DolphinScheduler <3.4.3 Auth Bypass via task-instance API
CVE-2026-66087 Published on October 8, 2026
Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint
An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the
* /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop
* /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-66087 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-66087
Want to know whenever a new CVE is published for Apache DolphinScheduler? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache DolphinScheduler:- Before 3.4.3 is affected.