CVE-2026-71898 in DolphinScheduler
Summary
by MITRE • 09/29/2026
An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/{projectCode}/workflow-instances/{id} endpoint. The endpoint does not enforce the write permission required for this operation, allowing the user to make unauthorized changes to workflow instances.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in Apache DolphinScheduler represents a critical failure in access control mechanisms within the workflow orchestration platform. Specifically, this flaw resides in the PUT /projects/{projectCode}/workflow-instances/{id} endpoint, which is designed to update or modify existing workflow instances. The core technical issue stems from an incorrect authorization check that fails to validate whether the authenticated user possesses write permissions for the specific project associated with the target workflow instance. Instead of verifying both read and write privileges required for modification operations, the system only confirms basic authentication and potentially insufficient read-level access rights. This oversight allows any user who has been granted at least read permission on a given project to execute state-changing actions against workflow instances within that same project scope.
From a technical perspective, this is a classic example of an insecure direct object reference combined with broken access control logic. The API endpoint accepts the project code and instance ID as parameters but does not cross-reference these inputs against the user's role-based permissions matrix to ensure write capabilities are present before processing the request payload. Consequently, the application state can be altered by actors who should only have observational rights over the data. This type of vulnerability is formally categorized under CWE-269 Improper Privilege Management and aligns with MITRE ATT&CK technique T1078 Valid Accounts when leveraged by an insider threat or compromised account seeking to disrupt operations without escalating privileges further.
The operational impact of this flaw can be severe in enterprise environments where Apache DolphinScheduler is used for managing complex data pipelines and distributed computing tasks. An attacker exploiting this vulnerability could modify running workflow instances, potentially causing job failures, resource exhaustion, or incorrect data processing outcomes. In scenarios involving sensitive ETL processes, unauthorized modifications might lead to data integrity issues or the execution of malicious logic embedded in updated workflows if such updates are permitted by other system configurations. Furthermore, because the attack requires only read access, which is often granted more broadly than write access for collaboration purposes, the blast radius of this vulnerability extends to a larger number of users within an organization compared to vulnerabilities requiring higher privilege levels.
Mitigation strategies primarily involve upgrading Apache DolphinScheduler to version 3.4.3 or later, where the authorization logic has been corrected to enforce strict write permission checks on workflow instance modification endpoints. For organizations unable to immediately patch their systems due to operational constraints, temporary mitigations should focus on tightening project-level access controls. Administrators can restrict read-only permissions by ensuring that users who do not require active management of workflows are assigned roles with strictly limited scopes or isolated projects where the risk of accidental or malicious workflow modification is minimized. Additionally, implementing robust API gateway rules or WAF policies to monitor for unusual patterns in PUT requests against workflow instance endpoints may provide an additional layer of defense while patching efforts proceed. Regular audits of user permissions and adherence to the principle of least privilege are essential long-term practices to prevent similar authorization bypasses across all components of the DolphinScheduler ecosystem.