CVE-2026-23902
Last modified
CVE-2026-23902 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution. This issue affects Apache DolphinScheduler versions prior to 3.4.1. Users are recommended to upgrade to version 3.4.1, which fixes this issue.. EPSS estimates a 0.45% chance of exploitation in the next 30 days.
Description
Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution. This issue affects Apache DolphinScheduler versions prior to 3.4.1. Users are recommended to upgrade to version 3.4.1, which fixes this issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Dolphinscheduler | < 3.4.1 |
References
- https://lists.apache.org/thread/hy4ntb2gys8150zfmnxhsd5ph0hoh7s9Mailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/04/24/1Mailing List, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-23902?
How severe is CVE-2026-23902?
How do I fix CVE-2026-23902?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-23896immich is a high performance self-hosted photo and video man…8.8
- CVE-2026-23897Apollo Server is an open-source, spec-compliant GraphQL serv…7.5
- CVE-2026-23898Lack of input validation leads to an arbitrary file deletion…7.2
- CVE-2026-23899An improper access check allows unauthorized access to webse…8.8
- CVE-2026-23900Various stored XSS vulnerabilities in the maps- and icon ren…6.5
- CVE-2026-23901Observable Timing Discrepancy vulnerability in Apache Shiro.…2.5
- CVE-2026-23903Authentication Bypass by Alternate Name vulnerability in Apa…5.3
- CVE-2026-23904Kyuubi Engine UI proxy accepts a host and port from the requ…7.3
- CVE-2026-23906Affected Products and Versions * Apache Druid * Affect…9.8
- CVE-2026-23907This issue affects the ExtractEmbeddedFiles example in Apac…5.3
- CVE-2026-23909Rejected reason: Not used
- CVE-2026-2391### Summary The `arrayLimit` option in qs does not enforce l…7.5
Are you affected by CVE-2026-23902?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST