Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution times, cron expressions, flow parameters, and notification email lists without proper authorization.
{
"cna_assigner": "VulnCheck",
"cwe_ids": [
"CWE-862"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93737.json"
}{
"extracted_events": [
{
"introduced": "0"
},
{
"last_affected": "4.0.0"
},
{
"fixed": "4.0.0"
}
],
"source": [
"AFFECTED_FIELD",
"DESCRIPTION",
"REFERENCES"
]
}
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93737.json"
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"304377622111916037647339144257773178283",
"29434081043907856174318322554078329338",
"315246368053642102925148981503509189957",
"108878271460510433429873108063503477141",
"313767305134959294085560864344378736248",
"220241644689818672610417551478955893882",
"312151525936498121668789573207676079843",
"44053386616740985147428836150179944558",
"120487342150556918107437448393035265049",
"206261858497101071144800408121024617918",
"76477380296555511037899310586830553793",
"143748002234855643313476481231943851234",
"137425726490219008262663449360875369056",
"169166190800931946393046886484642408645",
"236115063168572862429702455946546569164",
"300222121807722240903963273879315611570",
"316854818728770961114158501518886763731",
"241451992118107156783594433872120839583",
"301419833981306732881629073452713342123",
"300222121807722240903963273879315611570",
"120487342150556918107437448393035265049",
"275424733178453135183424556915284315127",
"74088822030001393018900617170805171485",
"174311555496824819407077324643894580694",
"249449821876542764977645530522374634827",
"176188197624748984489028617291766799763",
"101709545611670691711122903094176786811",
"279225586963278724976695647264658905152"
],
"threshold": 0.9
},
"id": "CVE-2026-93737-033ff5c3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/test/java/azkaban/executor/container/KubernetesContainerizedImplTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "265420992837450746933781851601871015202",
"length": 1951
},
"id": "CVE-2026-93737-0d35b2fc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/test/java/azkaban/imagemgmt/rampup/ImageRampupManagerImplTest.java",
"function": "testFetchVersionByImageTypesFailureCase"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"276570767770595122943148636936558734210",
"79677093140271038434616014668303508855",
"264458341702242945383586743610603473078",
"237497066324813745310976365883593302604",
"250245004841705697761993528240035772794",
"334679231965181122074385297810416902086",
"5030604993168683438599179800720514431",
"201194599521377702888700619880008693713",
"247357306177730748150283424811977796102",
"251986202177555273376078709429305713861",
"177097286055205977913896425178702186679",
"14130148927087874909663218257506766474",
"239768577251296527887811494512296770523",
"242690695715233268593969990223567540538",
"257628598375647654599603738458825275705",
"252819256762749063462301887659141295622",
"310254036057049644425847699902582426554",
"199148858181976328827908311813855474622",
"179369657725067595162226756473348725787",
"242110854848544863083234816416710909511",
"2154818020680322232710111951879119428",
"288950412225078351705701931360411042772",
"260030580745035064723658750650724230901",
"26914621957071737905995079569383049506",
"145997567982547112624877650236313145916",
"47004587523700726742370401136829694830",
"310254036057049644425847699902582426554",
"199148858181976328827908311813855474622",
"145997567982547112624877650236313145916",
"47004587523700726742370401136829694830",
"310254036057049644425847699902582426554",
"199148858181976328827908311813855474622",
"19301100867056472573049615072045625134",
"20750560937479427639010193356266154479",
"292520805432976135252003308450265873988",
"317777199075023908597926725362865645845",
"19301100867056472573049615072045625134",
"20750560937479427639010193356266154479",
"292520805432976135252003308450265873988",
"317777199075023908597926725362865645845"
],
"threshold": 0.9
},
"id": "CVE-2026-93737-16ca563b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/test/java/azkaban/imagemgmt/rampup/ImageRampupManagerImplTest.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"224817586287729307944956647161446769123",
"298016215331694006514691896009263256186",
"112036568539409268329905702361200876668",
"188909766636601271086873657802310461685",
"251831901380888598781809523745929340200"
],
"threshold": 0.9
},
"id": "CVE-2026-93737-227792bc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/test/java/azkaban/executor/ContainerizedDispatchManagerTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "293249449403896682306790988025983902368",
"length": 1055
},
"id": "CVE-2026-93737-295bfc42",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/main/java/azkaban/imagemgmt/rampup/ImageRampupManagerImpl.java",
"function": "processAndGetRandomRampupVersion"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "296817811312584780754595799884464361377",
"length": 1879
},
"id": "CVE-2026-93737-2be132e6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/test/java/azkaban/imagemgmt/rampup/ImageRampupManagerImplTest.java",
"function": "testFetchVersionByImageTypesCase2"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"195771405524534373225122245525917364687",
"139542554411607801636101344832700783515",
"256661410531567793700930853728957126386",
"25743441084858195525459546419812545144",
"241293097284360452832718402060589327621",
"152319018629247394617561552114331511499"
],
"threshold": 0.9
},
"id": "CVE-2026-93737-2d25da54",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/main/java/azkaban/imagemgmt/rampup/ImageRampupManager.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "206965316284107285563870515430377603347",
"length": 3150
},
"id": "CVE-2026-93737-37f442cd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/test/java/azkaban/executor/container/KubernetesContainerizedImplTest.java",
"function": "testVersionSetConstructionWithFlowOverrideParams"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "238730235624124748199714063921880156479",
"length": 234
},
"id": "CVE-2026-93737-4a7da635",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/main/java/azkaban/imagemgmt/rampup/ImageRampupManagerImpl.java",
"function": "getRandomNumberInRange"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "46927197399805053443638475817673614762",
"length": 1666
},
"id": "CVE-2026-93737-5b7c7107",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/main/java/azkaban/executor/container/KubernetesContainerizedImpl.java",
"function": "createPod"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "45264049714512464928408214915239097680",
"length": 2294
},
"id": "CVE-2026-93737-67221b2d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/test/java/azkaban/imagemgmt/rampup/ImageRampupManagerImplTest.java",
"function": "testFetchAllImageTypesVersion"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "92723402055622960450259352713957169019",
"length": 784
},
"id": "CVE-2026-93737-6cfae3ef",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/main/java/azkaban/imagemgmt/rampup/ImageRampupManagerImpl.java",
"function": "getVersionMetadataForAllImageTypes"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "65130035265378054341558376668217750495",
"length": 1832
},
"id": "CVE-2026-93737-6eca1f4d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/test/java/azkaban/imagemgmt/rampup/ImageRampupManagerImplTest.java",
"function": "testFetchAllImageTypesVersionFailureCase"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"141609580466419223603285167237785695100",
"220454206797462394635359453575831319881",
"57874545382866406048613268173289214554",
"337845339001622017789747509287864790206"
],
"threshold": 0.9
},
"id": "CVE-2026-93737-830a1e13",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/main/java/azkaban/executor/container/ContainerizedDispatchManager.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"213606854805730290227164859151555933895",
"313874447112247795025120473789059328467",
"187890461102228516436561385863382653864",
"313076434548139321854933848329357850691",
"21739303790092036402383943443575204428",
"229716192096428517025901786411415668028",
"334466901223500379748198438269220637107",
"59415642670876021295793694852667043756",
"227668413831052405161363901365250652126",
"103525175115441032130333853904873354655",
"129511768377889209692607536692438205466",
"218913308146914719884350851088691245004",
"21537919968395419880499427471428228852",
"299312794327517446401634514814287448893",
"129511768377889209692607536692438205466",
"218913308146914719884350851088691245004",
"317258706175826829910748993493296291209",
"21038201350028833844820169787417011684",
"163310709284604240507917568904525492180",
"231878364478533487887400713072933793044",
"216631832190614947712306412610719186201",
"88168735278731824692316675930000729565",
"216936609994368131590795861722732018649",
"199570920111938105744876951402750002247",
"235356836770541408358428230668066001699",
"218913308146914719884350851088691245004",
"21537919968395419880499427471428228852",
"150898201732638722174257008866410506699",
"1845532914535565875451453943052173920",
"108375669836761833573949272503594321836",
"105515400154401776380594169709331984762",
"130677832581141940432392024183273465909",
"32846867406584128351771407227686545941",
"57177430244680823088867850149378955879",
"55020035844618669678860108397500108310",
"201350339909811193338899184280025122719",
"211449349588834647883658913366448626657",
"88873910614790983768383403909898128534",
"285150107518744569349841914550671991994",
"99894291039000033313342155652315036166",
"314403270241792816513105551620635880959",
"104758546664223689560087388432295322203",
"265565595360202824569177000800946928801",
"61198944113475962675950849197987541899",
"43555545049756753144183312876540548901",
"243031366394266389438047412556769333942",
"5490373859338318135187319503874619921",
"260804528887236330191260042368556899043",
"249344779177795967532052919119668682902",
"208752889349915253699172735657689056581",
"1427705035390380213272550726585639493",
"48898519067240876842349473398201360011",
"230648917687015558394841583139911253322",
"44187702641847925214566806912073597780",
"279408243096652174506465269946087465932",
"112645471621012182828305149662038113598",
"259768195709896200902965952983484037366",
"321628529422231560046756048243806093978",
"93790390042326886608167723641958581187",
"314482182898757347257212806734200617551",
"315865626727880272423525396898675558481",
"57864160114868345401902485777001902177",
"60289936339121677750153181840173702624",
"198274183028497709670793492038120360978"
],
"threshold": 0.9
},
"id": "CVE-2026-93737-841214aa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/main/java/azkaban/imagemgmt/rampup/ImageRampupManagerImpl.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "323476836735681039483052867449460268698",
"length": 2224
},
"id": "CVE-2026-93737-9387b0e2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/main/java/azkaban/executor/container/KubernetesContainerizedImpl.java",
"function": "fetchVersionSet"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"171061446185096155055629790413976932338",
"338775895389469793175423111542579557228",
"122956236917493568617510744058774032937",
"40427142563542192266011047012232117860",
"98374248894867281602082133392820199623",
"321138805471285069936712516658737696777",
"225904584143191481756726766515495970494",
"280253625537971240974909437708794925990"
],
"threshold": 0.9
},
"id": "CVE-2026-93737-9a570b8f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/main/java/azkaban/executor/container/ContainerImplUtils.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "307914997712348522939773871323893964285",
"length": 424
},
"id": "CVE-2026-93737-9c8faff5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/main/java/azkaban/imagemgmt/rampup/ImageRampupManagerImpl.java",
"function": "fetchImageVersion"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "17671920929808631377146697592331081691",
"length": 1228
},
"id": "CVE-2026-93737-a7c29e69",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/test/java/azkaban/executor/container/KubernetesContainerizedImplTest.java",
"function": "testPodConstruction"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"127883636658970737918241581252607773571",
"171169878079331090737212076745092000019",
"287588406396096465193322289824840941954",
"267356999709151160839273109143846447882",
"37162116630568746907345425947234943064",
"269088420434380216936183127168371669021",
"138388122921134662469008663470006347632",
"183567410162826940041905914862808346755",
"160907330377340241752036338100858784072",
"337230404548664370066820090768298307706",
"324168069067872350355488616240836905846",
"189091672667828944555021646307671337541",
"226610490726180354055990163993539385814",
"141465897839216191376432680842940475662",
"286139683528250103731685896918017525169",
"67129200504382896691280559609687129459",
"41958070071516462868807150169279335623",
"15504383999579559198269814355692940930",
"292851467661430483762285151629439756757",
"304705036512801222782317752100653962836",
"8008220933078580654096340015752814994",
"269350574701318827484583453679691120396",
"206508603066548462616670310851953815538",
"324152704250679130189745900589395463644",
"146579820877914179572390820385711726580",
"146510815135971677873665645754272468109",
"306244051563868439873063353995667159819",
"92958525465652961408046956000192454959",
"266274749088426995904805745047920096952",
"58594700995821081147455548138307009653",
"123614752773396669363841207262144671169",
"199194044056995075396053541132861618887",
"329499449623293507513845111140301204980",
"96697339596508822127004815341569480267",
"203109490075820616855584109306778258951",
"136244373097061170677830492638330681198",
"58331151814674935291502515789584638942",
"259654625617938570813795557421563487678",
"182188225654507544343094170140698610169",
"152378560030408118167725444665811765717",
"320344214753157527636449518147617657819",
"259916519740779401997209324907150111779",
"145209666856754582758501262837801969706",
"85503428996593464376313495628604952706",
"146773770061878034420017499642563693107",
"223132877068953069389854635544379461897",
"48356070908024179345749334974972330166",
"4747695588006560568921457380999399688",
"275972241223076982409151289997779450857",
"210237846704773087034301640694336962603",
"219145176072893483399968494158887299013",
"112791483841673639326074361564528327138",
"27080053406788967934035218808076072142",
"150299675335022907282043192526638939040",
"7419214094416014939252635530005826551",
"335313026570879240796215635366526259368",
"23165774049749330743302970032119599993",
"110310244999694250454305945964358633401",
"93760635402948196900353663642437689631",
"137964163657598121208917394625387501377",
"198072297976885453262961616527940215857",
"336068992772880323652070612051772316943",
"49971482313960845794185274791644021920",
"288206838291479452785091046099749930208",
"43589650598044913411338013487990902306",
"250913488076178226413986902085320284546",
"195050968121879800878429989595063141066",
"215388534448456076397301159436765435909"
],
"threshold": 0.9
},
"id": "CVE-2026-93737-ab15487a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/main/java/azkaban/executor/container/KubernetesContainerizedImpl.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "71793506514271448377757570315874646371",
"length": 1209
},
"id": "CVE-2026-93737-af5639f8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/test/java/azkaban/imagemgmt/rampup/ImageRampupManagerImplTest.java",
"function": "testFetchVersionByImageTypesCase1"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "284609644176763239755366617577729291078",
"length": 1006
},
"id": "CVE-2026-93737-b9cf901d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/test/java/azkaban/executor/ContainerizedDispatchManagerTest.java",
"function": "testAllowAndDenyList"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "152438661530837644321845577268049583593",
"length": 522
},
"id": "CVE-2026-93737-c4023381",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/main/java/azkaban/imagemgmt/rampup/ImageRampupManagerImpl.java",
"function": "getVersionByImageTypes"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "186959970019869987231980444178647609018",
"length": 182
},
"id": "CVE-2026-93737-d77277f6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/main/java/azkaban/executor/container/ContainerizedDispatchManager.java",
"function": "getDispatchMethod"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "3941234016100376760269130758599527632",
"length": 677
},
"id": "CVE-2026-93737-ddb7e669",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/main/java/azkaban/imagemgmt/rampup/ImageRampupManagerImpl.java",
"function": "getVersionForAllImageTypes"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"322247942572284648632844133868515089293",
"275462535147126301999013593271016058083",
"38711941575322468090748716879632588027",
"227482358650102084178761144995356529431",
"242034428891048912203386154648968087878",
"72442795765544645223738717822600809412",
"89215644242862759862083286768378517051",
"16888260671123706730848637731492414412",
"8588880473538734261315791332501086901",
"163937497076534869170902614262241712937",
"64372191602295371780450358528988928049",
"323046740804100458634041948662468069215"
],
"threshold": 0.9
},
"id": "CVE-2026-93737-df4759e0",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/main/java/azkaban/executor/container/ContainerRampUpCriteria.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "91948555634044411143360557994941408355",
"length": 1447
},
"id": "CVE-2026-93737-e340102a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/main/java/azkaban/imagemgmt/rampup/ImageRampupManagerImpl.java",
"function": "processAndGetVersionForImageTypes"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "201603511712312253653344456768421985392",
"length": 1433
},
"id": "CVE-2026-93737-e9b987c5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/azkaban/azkaban/commit/9018fa2c4afb71b8b86cb8d5092d50d8bcf9c7e1",
"target": {
"file": "azkaban-common/src/test/java/azkaban/executor/container/KubernetesContainerizedImplTest.java",
"function": "testVersionSetConstructionWithRampupManager"
}
}
]
"2026-09-24T08:22:23Z"