CVE-2026-66084

HighCVSS 8.1/10Last modified Oct 8, 2026

Description

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint.

The endpoint fails to verify that the task definition identified by code belongs to the project specified by projectCode. An authenticated user can supply the code of a project they are authorized to access together with a task definition code from another project, bypassing project access restrictions and modifying the target task definition and its upstream dependencies.

This vulnerability can compromise workflow integrity and disrupt task execution in unauthorized projects.This issue affects Apache DolphinScheduler: before 3.4.3.

Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Oct 8, 2026
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-660855.5In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local inf CVE-2026-660869.8In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 message CVE-2026-660878.1An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are no CVE-2026-660889.4In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands withou CVE-2026-660896.1In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This CVE-2026-66096.3A flaw has been found in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function form_valid of the file oauth/views.py. CVE-2026-660907.1In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create CVE-2026-660916.9In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthent CVE-2026-660924.8In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation.CVE-2026-660986.5The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into CVE-2026-66103.7A vulnerability has been found in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file djangoblog/CVE-2026-661098.5A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker wh