CVE-2026-57590 in DolphinScheduler
Summary
by MITRE • 09/24/2026
A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/24/2026
Apache DolphinScheduler is a distributed and easy-to-extensible visual DAG workflow scheduling platform designed for data processing tasks such as ETL jobs, machine learning pipelines, and complex business workflows. It allows users to define task dependencies through directed acyclic graphs (DAGs) and schedule them across various execution engines. Within this architecture, Task Groups serve as logical containers that organize related tasks, often corresponding to specific projects or teams within an organization. The platform relies on a robust authentication and authorization mechanism to ensure that only authorized personnel can view, modify, or execute these workflows. However, a critical security flaw was identified in the API endpoints responsible for managing Task Group resources prior version 3.4.3 of Apache DolphinScheduler. This vulnerability stems from a failure in implementing proper access control checks on specific server-side functions.
The core technical deficiency lies in the missing authorization logic within the Task Group APIs. When an authenticated user requests information about or attempts to manipulate a Task Group, the system correctly verifies that the user is logged into the platform but fails to validate whether that specific user possesses the necessary permissions for the project associated with the target Task Group. In a secure implementation, every request involving sensitive resources must undergo two distinct checks: authentication, which confirms identity, and authorization, which confirms permission levels relative to the resource being accessed. The vulnerability represents a classic Broken Access Control flaw where the application assumes that membership in the system implies access to all associated project data unless explicitly restricted by other means. This oversight allows any authenticated user with valid credentials for the DolphinScheduler instance to bypass intended restrictions.
The operational impact of this vulnerability is significant, particularly in multi-tenant environments or organizations using DolphinScheduler for sensitive business operations. An attacker who has obtained legitimate credentials can enumerate and access Task Groups belonging to projects they are not authorized to view. This exposure may lead to the disclosure of confidential workflow definitions, which often contain proprietary logic, internal network addresses, database connection strings, and other infrastructure details. Furthermore, depending on the specific API endpoints affected, an attacker might be able to modify or delete task group configurations, potentially disrupting scheduled jobs, causing service outages, or introducing malicious tasks into existing workflows. This lack of granular access control undermines the integrity and confidentiality guarantees provided by the platform's security model.
From a classification perspective, this vulnerability aligns with CWE-284: Improper Access Control, specifically reflecting scenarios where authorization checks are omitted for specific API functions. In terms of offensive tactics, it maps to MITRE ATT&CK technique T1078: Valid Accounts, as the exploitation relies on using legitimate credentials to access unauthorized resources, and potentially T1530: Data from Cloud Storage Object if sensitive data is exfiltrated through these endpoints. The vulnerability highlights a common pitfall in web application development where developers focus heavily on authentication mechanisms while neglecting fine-grained authorization checks for every individual resource operation.
To mitigate this risk, organizations running Apache DolphinScheduler must upgrade to version 3.4.3 or later immediately. This release includes the necessary code changes to enforce proper permission verification before allowing access to Task Group resources associated with specific projects. For environments where an immediate upgrade is not feasible due to operational constraints, administrators should consider implementing network-level controls such as firewall rules or reverse proxy configurations that restrict API endpoint access to trusted IP ranges if possible. Additionally, reviewing and tightening the role-based access control (RBAC) policies within DolphinScheduler can help minimize the blast radius of any potential exploitation by ensuring users have only the minimum permissions required for their roles. Regular security audits and penetration testing should be conducted to verify that authorization logic is consistently applied across all API endpoints in future updates.