CVE-2026-23902

HighCVSS 8.1/10Last modified Oct 26, 2026

Description

Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.

This issue affects Apache DolphinScheduler versions prior to 3.4.1.

Users are recommended to upgrade to version 3.4.1, which fixes this issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache DolphinScheduler	< 3.4.1

References

https://lists.apache.org/thread/hy4ntb2gys8150zfmnxhsd5ph0hoh7s9Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/24/1Mailing List, Third Party Advisory

Timeline

Published: Apr 24, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-239035.3Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommende CVE-2026-239047.3Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with CVE-2026-239069.8Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) * Prerequisit CVE-2026-239075.3This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEm CVE-2026-23917.5### Summary The `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attacke CVE-2026-239188.8Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. This issue affects Apache HTTP Server: 2.4.66. CVE-2026-239196.0For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts (used in script items, JavaScript reprocessing, Webhooks). CVE-2026-239208.8Host and event action script input is validated with a regex (set by the administrator), but the validation runs in multiline mode. If ^ and CVE-2026-239218.8A low privilege Zabbix user with API access can exploit a blind SQL injection vulnerability in include/classes/api/CApiService.php to execut CVE-2026-239224.9The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoin CVE-2026-239235.3An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on e CVE-2026-239244.9Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An