CVE-2026-71897 in DolphinScheduler
Summary
by MITRE • 09/29/2026
An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in Apache DolphinScheduler prior to version 3.4.3 represents a critical failure in access control mechanisms within the application's workflow management subsystem. Specifically, the flaw resides in the improper authorization checks associated with the batch-copy and batch-move API endpoints. These endpoints are designed to facilitate the duplication or relocation of workflow definitions across different projects within the DolphinScheduler environment. In a properly secured system, any operation that modifies resources belonging to another user or project must verify that the requesting authenticated user possesses explicit administrative privileges for the target resource. However, in this vulnerable version, the server fails to enforce these permissions correctly during batch operations. This means that while the initial login and session establishment are handled securely through standard authentication protocols, the subsequent authorization logic governing specific actions on workflow objects is insufficiently validated against the project-level access control lists.
From a technical perspective, this flaw allows an authenticated user with limited privileges in one project to exploit the API endpoints to interact with workflows located in other projects where they have no designated role or permissions. The batch nature of these operations exacerbates the risk, as it enables the bulk transfer or duplication of multiple workflow definitions simultaneously rather than just a single item. This lack of granular permission verification effectively bypasses the intended isolation boundaries between different tenant projects or user groups within the multi-tenant architecture of DolphinScheduler. An attacker who has obtained valid credentials for any account can leverage this misconfiguration to access, duplicate, or reorganize workflow logic that they are not authorized to view or modify. This constitutes a classic instance of Insecure Direct Object Reference combined with Broken Access Control, where the application trusts client-supplied identifiers without adequately verifying the requester's rights over those specific objects in the context of their current project scope.
The operational impact of this vulnerability is significant for organizations relying on DolphinScheduler for complex data pipeline orchestration and job scheduling. By copying workflows from unauthorized projects, an attacker can gain insight into proprietary business logic, ETL processes, or sensitive integration points that were intended to be kept confidential within specific teams or departments. Furthermore, moving these workflows allows the attacker to potentially disrupt existing operations by altering dependencies or executing jobs in unintended contexts. If the copied workflows contain credentials for downstream systems such as databases, message queues, or cloud storage services embedded within their configuration, this could lead to further compromise of those external assets. The ability to manipulate workflow structures also poses a risk to system stability and integrity, potentially causing service disruptions if critical dependencies are broken or misconfigured through unauthorized moves.
This vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization in the Common Weakness Enumeration taxonomy. In terms of offensive security frameworks, it maps directly to MITRE ATT&CK technique T1078 Valid Accounts, as exploitation requires initial authentication, followed by T1530 Data from Information Repositories if data exfiltration occurs via copying, and potentially T1496 Resource Hijacking or T1529 System Shutdown/Defacement if the moved workflows are executed maliciously. The core issue is a failure to implement proper object-level access control checks before performing state-changing operations on resources outside the user's designated domain.
To mitigate this risk, organizations running Apache DolphinScheduler must upgrade immediately to version 3.4.3 or later, where these authorization checks have been corrected to ensure that batch-copy and batch-move operations strictly validate project ownership and user permissions against the target workflows. Until an upgrade is feasible, administrators should consider implementing network-level controls such as Web Application Firewalls to restrict access to the affected API endpoints based on IP reputation or known attack patterns, although this is a less robust defense than patching the underlying code. Additionally, reviewing audit logs for unusual batch operations involving cross-project resource manipulation can help detect potential exploitation attempts in real-time. It is also advisable to enforce strict least-privilege principles across all user accounts and projects within the DolphinScheduler instance to minimize the blast radius should any future vulnerabilities arise.