CVE-2026-93737 in Azkaban
Summary
by MITRE • 09/18/2026
Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution times, cron expressions, flow parameters, and notification email lists without proper authorization.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in Azkaban versions through 4.0.0 represents a critical failure in access control mechanisms within the web application interface. Specifically, the flaw resides in the ScheduleServlet fetchSchedule action, which is responsible for retrieving scheduling configurations for various projects managed by the platform. In a properly secured environment, any request to view or modify project-specific data must be validated against the permissions of the authenticated user initiating the request. However, this implementation fails to perform adequate authorization checks before processing the input parameters provided by the client. This omission allows an attacker who has successfully authenticated to Azkaban to bypass intended security boundaries and access sensitive configuration details belonging to projects they do not own or have no business accessing.
From a technical perspective, the core issue is a broken object level reference vulnerability where the application relies on user-supplied input for project identifiers without verifying that the requesting user possesses the necessary privileges for those specific objects. When an attacker supplies arbitrary project and flow identifiers in their HTTP requests to the fetchSchedule endpoint, the server processes these inputs directly without cross-referencing them against the user's permission set or role assignments. This lack of server-side validation means that the application treats all authenticated users as having equal access rights regarding schedule data retrieval, regardless of their actual assigned roles such as viewer, executor, or admin within specific projects.
The operational impact of this vulnerability is significant due to the sensitivity of the information exposed. Schedule configurations often contain execution times and cron expressions which reveal the timing logic of critical business processes. Furthermore, flow parameters may include internal configuration details that could aid in further exploitation attempts against downstream systems. Most critically, notification email lists are exposed, providing attackers with a curated list of active user accounts associated with specific projects. This information can be leveraged for targeted phishing attacks or social engineering campaigns aimed at compromising higher-privileged accounts within the organization. The exposure of these details effectively undermines the confidentiality guarantees provided by Azkaban's authentication layer.
This vulnerability aligns closely with CWE-284, which describes Improper Access Control, specifically highlighting failures in authorization checks that allow unauthorized access to resources. In terms of offensive security frameworks, this behavior is characteristic of ATT&CK technique T1078, Valid Accounts, where an attacker uses legitimate credentials to gain initial access and then exploits misconfigurations or logic flaws to escalate privileges or exfiltrate data beyond their intended scope. The ability to enumerate schedules across the entire platform effectively turns a single authenticated account into a reconnaissance tool for mapping out the infrastructure's operational rhythms and dependencies.
To mitigate this vulnerability, immediate patching is required by upgrading Azkaban to version 4.0.1 or later where these permission checks have been implemented in the ScheduleServlet logic. For organizations unable to upgrade immediately due to compatibility constraints, network-level controls such as web application firewalls can be configured to monitor for anomalous patterns of requests targeting multiple distinct project identifiers from a single session. Additionally, implementing strict input validation and ensuring that all API endpoints enforce role-based access control checks before returning any data is essential. Security teams should also audit existing user permissions to ensure the principle of least privilege is applied, minimizing the potential blast radius if an account is compromised. Regular security assessments focusing on authorization logic are recommended to detect similar flaws in other parts of the application architecture.