CVE-2026-47340: Apache DolphinScheduler Unauthorized Alert Instance Access

Technical summary

Apache DolphinScheduler versions prior to 3.4.2 contain an access control vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) where the alert instance API or retrieval logic does not properly enforce permission boundaries tied to alert group ownership. An authenticated user can craft requests to retrieve alert instances belonging to alert groups for which they lack explicit permission. The vulnerability manifests as inadequate authorization checks in the alert instance access pathway, allowing horizontal privilege escalation within the application's multi-tenant or multi-group architecture.

Business impact

This vulnerability allows internal users or compromised user accounts to conduct unauthorized reconnaissance within DolphinScheduler deployments. Alert instances may contain sensitive configuration, monitoring parameters, or operational metadata relevant to scheduler tasks. Unauthorized access could enable competitors, malicious insiders, or attackers pivoting through a compromised account to map infrastructure, identify critical jobs, or gather intelligence for further attacks. In regulated environments, this may also constitute a compliance violation if alert data is classified as sensitive or subject to access controls.

Affected systems

Apache DolphinScheduler versions before 3.4.2 are vulnerable. Users running 3.4.1, 3.4.0, 3.3.x, 3.2.x, or earlier are affected. DolphinScheduler is a distributed workflow scheduler used in data pipeline and job orchestration scenarios; organizations deploying it in production should audit their installed versions immediately. The vulnerability does not require network exposure—it is exploitable by any authenticated user on the system, whether granted through direct credentials or via compromised accounts.

Exploitability

Exploitability is straightforward for anyone with valid DolphinScheduler credentials. No special techniques, social engineering, or race conditions are required; the attacker simply queries alert instance APIs with permissions they should not possess. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U) reflects that network access and low attack complexity are required, but crucially PR:L (Low Privilege required) means any authenticated user qualifies. The lack of KEV designation and no known public exploit activity suggests active exploitation in the wild is currently limited, but the ease of exploitation means this should be treated as high-risk in shared or multi-user environments.

Remediation

Upgrade Apache DolphinScheduler to version 3.4.2 or later. This version includes fixes to the alert instance authorization logic. Administrators should plan patching during a maintenance window. If immediate patching is not feasible, implement network-level access controls to restrict DolphinScheduler API access to trusted users and monitor API logs for suspicious alert instance queries. After patching, verify that user permissions are correctly enforced by testing cross-group alert queries with restricted accounts.

Patch guidance

Apply Apache DolphinScheduler version 3.4.2 or newer as published by the Apache Software Foundation. Consult the official DolphinScheduler release notes and security advisories to confirm patch availability for your deployment environment (Docker, Kubernetes, standalone binary, etc.). Verify the upgrade path from your current version—some organizations may need to stage intermediate releases. Post-upgrade, restart all scheduler nodes and re-test permission controls to confirm the fix is functional in your environment. Maintain current patching practices by subscribing to Apache DolphinScheduler security mailing lists.

Detection guidance

Monitor DolphinScheduler audit or application logs for alert instance API calls by users who do not own the corresponding alert groups. Look for repeated 200 OK responses to alert instance endpoints where the requesting user's group membership does not align with the alert group ID in the request. If your deployment includes WAF or API gateway logging, flag requests that retrieve alert instances with mismatched ownership. Behavioral anomalies such as a single account accessing alert instances across many different alert groups in a short time window are suspicious. Compare user permission matrices against actual API access patterns to surface unauthorized queries.

Why prioritize this

Although CVSS score is 6.5 (Medium), prioritization should reflect context. In shared or multi-tenant DolphinScheduler deployments where users have different trust levels or team boundaries, this is a higher-priority fix because it enables lateral information disclosure. The lack of integrity or availability impact keeps it from critical tier, but the low attack complexity and low barrier to exploitation (only requires authentication) mean this should be patched within 30 days in most environments. Organizations using DolphinScheduler for sensitive data pipelines or compliance-regulated workloads should prioritize even more aggressively.

Risk score, explained

CVE-2026-47340 scores 6.5 (MEDIUM) under CVSS 3.1. The primary driver is the high confidentiality impact (C:H)—authenticated users can access alert data they should not see. Attack vector (AV:N) and low attack complexity (AC:L) favor exploitation, but the requirement for prior authentication (PR:L) and lack of system-wide scope (S:U) prevent a higher score. Integrity and availability are not impacted (I:N/A:N), limiting severity. Context matters: in an environment with strict least-privilege controls and air-gapped networks, this may feel lower-risk; in a shared multi-user system, the practical risk is higher due to ease of exploitation by insider threats.

Frequently asked questions