GHSA-72mv-wwvm-vgp5

Apache DolphinScheduler has an Incorrect Authorization Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2026-23902

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.dolphinscheduler:dolphinscheduler	< 3.4.1	3.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution. This issue affects Apache DolphinScheduler versions prior to 3.4.1. Users are recommended to upgrade to version 3.4.1, which fixes this issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-23902 advisory
https://github.com/apache/dolphinscheduler package
https://lists.apache.org/thread/hy4ntb2gys8150zfmnxhsd5ph0hoh7s9 web
http://www.openwall.com/lists/oss-security/2026/04/24/1 web