CVE-2026-42357: Apache DolphinScheduler Incorrect Authorization Allows Cross-Project Workflow Access

Technical summary

CVE-2026-42357 is an Incorrect Authorization vulnerability (CWE-863) in Apache DolphinScheduler prior to version 3.4.2. The issue stems from insufficient access control validation when retrieving workflow instance information. Authenticated users can bypass project-level authorization controls to access workflow instances belonging to projects they lack explicit permission to view. The vulnerability is network-accessible and requires only basic user-level authentication; no special configuration, interaction, or additional privileges are needed for exploitation. The flaw results in confidentiality impact through unauthorized information disclosure.

Business impact

In production DolphinScheduler deployments, this vulnerability enables lateral data exposure across project silos. Users with access to one project can discover and monitor workflows, task execution patterns, and operational metadata from other projects—potentially exposing business logic, data processing workflows, and scheduling patterns to unauthorized personnel. In regulated environments (finance, healthcare, compliance-sensitive operations), this cross-project visibility breach could violate data segregation requirements and increase audit risk. Multi-tenant or shared-cluster scenarios face heightened exposure, as one customer's credentials could expose another customer's workflow intelligence.

Affected systems

Apache DolphinScheduler versions prior to 3.4.2 are affected. Any organization running DolphinScheduler in a shared, multi-project, or multi-tenant configuration is at risk. The vulnerability affects both on-premises and cloud-hosted deployments where workflow instance visibility is intended to be project-scoped.

Exploitability

Exploitability is moderate to high. An attacker must possess valid DolphinScheduler user credentials, but does not require administrative access or out-of-band tricks. Once authenticated, the attacker can perform reconnaissance of projects and workflows across the system with low operational cost. No user interaction, network complexity, or special attack conditions are required. The CVSS 3.1 score of 6.5 (Medium) reflects the confidentiality impact and low attack complexity, tempered by the requirement for prior authentication.

Remediation

Upgrade Apache DolphinScheduler to version 3.4.2 or later. This version includes corrected authorization logic that enforces project-scoped access controls on workflow instance queries. For organizations unable to upgrade immediately, consider restricting user account provisioning to essential personnel only and implement network-level access controls to limit DolphinScheduler UI exposure to trusted networks.

Patch guidance

Apply Apache DolphinScheduler version 3.4.2 as the minimum remediation. Verify the patch version against the official Apache DolphinScheduler release notes and security advisories. Test the upgrade in a non-production environment first to confirm compatibility with existing workflows and integrations. If you are running a version between the affected range and 3.4.2, prioritize the upgrade within your standard change management window.

Detection guidance

Monitor DolphinScheduler access logs and audit trails for cross-project workflow instance queries by users who should not have visibility into those projects. Look for patterns of users accessing workflow details from multiple unrelated projects in short timeframes. Enable detailed logging on API endpoints that retrieve workflow instances (typically /api/v1/projects/{projectId}/instance) and correlate user identity with requested project IDs. Network-based detection is limited since the vulnerability exploits legitimate authenticated sessions; focus on application-level access patterns.

Why prioritize this

Although marked as CVSS Medium (6.5), this vulnerability warrants prompt attention in multi-project environments because it directly undermines data segregation—a core security boundary in workflow orchestration platforms. The low barrier to exploitation (existing credentials only) and the potential for sensitive operational data exposure justify treating this as higher priority in organizations with strict data compartmentalization requirements. The lack of KEV status does not reduce urgency in affected deployments.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a Medium severity rating driven by high confidentiality impact (unauthorized access to workflow instance data) and low attack complexity (straightforward authorization bypass). The score is constrained by the requirement for prior authentication (PR:L) and the absence of integrity or availability impact. In environments with sensitive workflows or regulatory data handling requirements, the real-world risk may exceed the numeric score due to business context.

Frequently asked questions