CVE-2026-41280: Apache DolphinScheduler Incorrect Authorization in Task Definition Deletion

Technical summary

This is an Incorrect Authorization vulnerability (CWE-863) in Apache DolphinScheduler where the application fails to properly validate user permissions before allowing deletion of task definitions. The flaw permits authenticated users holding system login privileges to circumvent project-level access controls and delete task definitions across project boundaries. The CVSS 3.1 score of 4.9 (MEDIUM severity) reflects a network-accessible attack vector with high privilege requirements, high integrity impact (unauthorized modification/deletion), and no confidentiality or availability impact in the base scoring. The vulnerability exists in versions prior to 3.4.2.

Business impact

An insider with system access or a compromised account with system privileges could systematically remove task definitions from other projects, disrupting scheduled workflows without proper authorization. This could lead to failed automation, missed data processing jobs, and operational delays. The impact is most severe in environments where DolphinScheduler orchestrates critical business processes such as data pipelines, ETL workflows, or scheduled reporting. While the attack requires elevated privileges, the lack of project-level authorization enforcement creates an unnecessary internal risk that undermines role-based access control boundaries.

Affected systems

Apache DolphinScheduler versions prior to 3.4.2 are affected. This includes all 3.4.x versions up to but not including 3.4.2, as well as earlier major versions (3.3.x, 3.2.x, etc.). Organizations running DolphinScheduler for workflow orchestration should verify their current version and prioritize upgrades. Community distributions and enterprise deployments derived from the Apache project are in scope.

Exploitability

Exploitation requires valid system login credentials. The attack is straightforward once authenticated—no complex multi-step exploitation or race conditions are needed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting no active weaponized exploits in the wild as of the publication date. However, the attack surface is bounded to trusted users within an organization, which limits but does not eliminate risk, particularly in environments with shared credentials or where insider threats are a concern.

Remediation

Upgrade Apache DolphinScheduler to version 3.4.2 or later. This version includes fixes for the authorization validation logic to ensure task definition deletion is properly gated by project-level permissions. Before upgrading, review your access control policies to confirm which users hold system-level privileges and whether that scope is justified. Consider implementing additional compensating controls such as audit logging on task definition deletions and periodic access reviews.

Patch guidance

Apply the official Apache DolphinScheduler version 3.4.2 or newer according to your deployment architecture (standalone, Docker, Kubernetes, etc.). Verify the patch through the Apache DolphinScheduler release notes and official distribution channels. Test the upgrade in a non-production environment first to ensure compatibility with your existing task definitions and workflows. Plan a maintenance window if necessary; most patches are drop-in replacements. After patching, validate that authorization controls are functioning by testing task deletion attempts from unprivileged project accounts—these should fail.

Detection guidance

Monitor application logs for task definition deletion events, paying particular attention to deletions initiated by high-privilege accounts on projects those accounts do not directly own. Implement audit trails that capture the user, timestamp, task definition ID, and project identifier for all deletion operations. Review IAM/access control logs to identify any recent privilege escalations or anomalous account logins with system-level roles. Network-based detection is limited since the vulnerability is exploited through normal API calls; focus on application-level telemetry and access logs. Establish baseline behavior for authorized deletions and alert on deviations.

Why prioritize this

Prioritize this vulnerability for patching primarily due to its direct impact on access control integrity. While the CVSS score is MEDIUM and exploitation requires high privileges, the vulnerability undermines the fundamental security model of multi-project environments. Insider threats and compromised high-privilege accounts are realistic attack scenarios in many organizations. The fix is available and straightforward to deploy. Prioritize patching within 30 days for production systems; expedite if your DolphinScheduler instance handles sensitive data pipelines or mission-critical workflows.

Risk score, explained

The CVSS 3.1 score of 4.9 reflects a network-accessible service (AV:N) with low attack complexity (AC:L) but high privilege requirements (PR:H). There is no user interaction required (UI:N), scope is unchanged (S:U), and the impact is high for integrity (I:H) but none for confidentiality (C:N) or availability (A:N). The score appropriately captures that while the vulnerability requires authenticated access with elevated privileges, the integrity impact of unauthorized resource deletion in a workflow orchestration tool is significant. The vulnerability is not actively exploited (not on KEV), which lowers practical urgency relative to critical flaws, but the ease of exploitation for privileged users keeps it in the MEDIUM risk tier.

Frequently asked questions