Apache DolphinScheduler 3.4.3 Improper Auth: batch-copy/move allow Access
CVE-2026-71897 Published on September 29, 2026
Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints
An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
Vulnerability Analysis
CVE-2026-71897 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-71897 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-71897
Want to know whenever a new CVE is published for Apache DolphinScheduler? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache DolphinScheduler:- Before 3.4.3 is affected.