CVE-2026-71899 in DolphinScheduler
Summary
by MITRE • 09/29/2026
A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried.
An authenticated user who does not have permission to access a specific project can invoke the API with parameters referencing workflows belonging to that project and retrieve workflow information. This allows users to access workflow data outside their authorized project scope, resulting in unauthorized information disclosure.
This issue affects Apache DolphinScheduler: from 3.2.0 before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified within Apache DolphinScheduler represents a critical failure in access control mechanisms, specifically categorized under CWE-862: Missing Authorization. This flaw resides in the query-dynamic-sub-workflows API endpoint, which is designed to retrieve information about dynamic sub-workflows. In a properly secured system, any request for sensitive operational data must be rigorously validated against the user's assigned roles and permissions before returning results. However, in versions of Apache DolphinScheduler ranging from 3.2.0 up to but not including 3.4.3, this validation step is absent or insufficiently implemented. The application correctly authenticates the user, ensuring they are a valid member of the system, but it fails to verify whether that specific authenticated identity possesses the requisite privileges for the target resource. This distinction between authentication and authorization is fundamental in security architecture, and its absence creates a significant gap that attackers can exploit to bypass intended access restrictions.
From an operational perspective, this vulnerability allows any authenticated user who lacks explicit permission for a particular project to query workflow details belonging to that restricted project. By manipulating the parameters passed to the API endpoint, such as specifying identifiers associated with unauthorized projects or workflows, a malicious actor can retrieve sensitive configuration data, execution logs, and structural information about workflows they are not supposed to see. This constitutes an unauthorized information disclosure vulnerability where the scope of accessible data extends far beyond what is permitted by the system's role-based access control policies. The impact includes potential exposure of proprietary business logic embedded within workflow definitions, insights into internal infrastructure configurations, and potentially sensitive credentials or environment variables stored as part of task parameters. Such leakage can serve as reconnaissance material for further attacks, enabling adversaries to map out the organization’s data processing pipelines and identify additional targets for exploitation.
This behavior aligns with several tactics described in the MITRE ATT&CK framework, particularly those related to Discovery and Collection. The ability to enumerate resources outside of one's authorized scope facilitates lateral movement planning and deeper understanding of the target environment without triggering typical access denial alerts that might occur if a user attempted to directly open unauthorized pages through the graphical interface. Attackers can automate queries against this API endpoint using tools like curl or custom scripts, systematically harvesting data from multiple projects in an unauthenticated manner relative to project-level permissions. The lack of proper server-side validation means that client-side restrictions are easily bypassed, as the security decision is not enforced at the application logic layer where it belongs.
To mitigate this risk and restore secure access control practices, organizations running affected versions must upgrade Apache DolphinScheduler to version 3.4.3 or later immediately. The patched release includes corrections to the authorization checks within the query-dynamic-sub-workflows API, ensuring that requests are validated against the user's project-level permissions before any data is returned. In addition to upgrading, administrators should review their existing access control policies and ensure that principle of least privilege is strictly enforced across all projects and users. Regular security audits focusing on API endpoints can help identify similar authorization flaws in other parts of the application. Monitoring logs for unusual patterns of workflow queries from unexpected user accounts may also provide early detection indicators if such vulnerabilities were present or exploited prior to patching.