CVE-2026-23902

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-23902

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23902.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-23902

Aliases

GHSA-72mv-wwvm-vgp5

Published

2026-04-24T10:56:18.289Z

Modified

2026-07-15T01:49:17.257883619Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.

Details

Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.

This issue affects Apache DolphinScheduler versions prior to 3.4.1.

Users are recommended to upgrade to version 3.4.1, which fixes this issue.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23902.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "3.4.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-863"
    ]
}

References

Affected packages

Git / github.com/apache/dolphinscheduler

Affected ranges

Type

GIT

Repo

https://github.com/apache/dolphinscheduler

Events

Introduced

Fixed

f19eb8ce7dc4d7c0be9e213610d6812718294333

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.4.1"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*"
}

Affected versions

1.*

1.1.0-preview

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23902.json"