CVE-2026-57590

HighCVSS 8.1/10Last modified Sep 24, 2026

Description

A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group.

This issue affects Apache DolphinScheduler: before 3.4.3.

Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 24, 2026
Last modified
Sep 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-575996.6There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attacCVE-2026-57609.8SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_templatCVE-2026-576007.5Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sCVE-2026-576176.5Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions.CVE-2026-576186.5Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions.CVE-2026-576196.5Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions.CVE-2026-57625.3Allocation of resources without limits or throttling vulnerability in Wikimedia Foundation MediaWiki - ReportIncident Extension allows HTTP CVE-2026-576206.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons ElementoCVE-2026-576219.8Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions.CVE-2026-576224.3Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.CVE-2026-576239.0Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions.CVE-2026-5762410.0Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.