CVE-2026-49050: Apache DolphinScheduler Auth Bypass Flaw

CVE-2026-49050 Overview

CVE-2026-49050 is a broken access control vulnerability in Apache DolphinScheduler. The flaw allows an authenticated general user to mint admin-level access tokens through the /access-tokens API endpoint. The issue affects all versions prior to 3.4.2 and stems from missing authorization enforcement on token creation requests [CWE-863].

An attacker with any valid low-privilege account can request tokens that grant administrative capabilities. This enables horizontal and vertical privilege escalation across the scheduler, including workflow manipulation, task definition changes, and access to sensitive scheduling data.

Critical Impact
A low-privileged user can obtain admin access tokens, gaining full control over DolphinScheduler workflows, tasks, and configurations.

Affected Products

Apache DolphinScheduler versions before 3.4.2
Apache DolphinScheduler 3.x release line prior to the fix
All deployments exposing the /access-tokens REST endpoint to authenticated users

Discovery Timeline

2026-08-25 - CVE-2026-49050 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-49050

Vulnerability Analysis

Apache DolphinScheduler exposes a REST endpoint at /access-tokens used to issue API tokens for automation and integration. The endpoint accepts a userId parameter identifying the account the token will be bound to. In vulnerable releases, the server does not verify that the requesting user matches the userId in the request or holds administrative privileges.

An authenticated general user can therefore submit a token creation request specifying an admin userId. The server issues a valid access token bound to that admin account. The attacker then presents the token to any DolphinScheduler API and operates with administrative authority.

This authorization gap converts every authenticated account into a stepping stone for full application takeover. Impacted operations include creating and executing workflows, modifying tenants, reading data source credentials, and altering worker group assignments.

Root Cause

The root cause is missing server-side authorization on the token issuance handler. The controller trusts the userId field from the request body without enforcing that either the caller equals the target user or the caller belongs to the admin role. This maps directly to CWE-863: Incorrect Authorization.

Attack Vector

Exploitation requires network access to the DolphinScheduler API and a valid low-privilege session or API token. The attacker authenticates normally, then issues a POST request to /dolphinscheduler/access-tokens with a payload targeting an admin userId. The server responds with an admin-scoped token, which the attacker uses for subsequent API calls. No user interaction is required, and the attack completes in a single request pair.

Detailed discussion is available on the Apache Thread Discussion and the Open Wall Security Update.

Detection Methods for CVE-2026-49050

Indicators of Compromise

POST requests to /dolphinscheduler/access-tokens where the authenticated session belongs to a non-admin user but the userId field targets an admin account
New entries in the t_ds_access_token database table associated with admin user IDs but created by non-admin sessions
API activity using access tokens where the requesting client IP or user-agent differs from the historical baseline for that admin identity

Detection Strategies

Correlate authentication logs with /access-tokens audit events to flag mismatches between session owner and token userId
Alert on privilege-escalation patterns where a low-privilege account is quickly followed by admin-scoped API activity from the same source
Baseline normal token issuance rates and trigger on volume spikes or off-hours creation

Monitoring Recommendations

Enable verbose API access logging on the DolphinScheduler API server and forward to a central log store
Monitor changes to workflow definitions, tenants, and data source credentials for unauthorized modifications
Track token usage per identity and flag tokens issued shortly before sensitive administrative actions

How to Mitigate CVE-2026-49050

Immediate Actions Required

Upgrade Apache DolphinScheduler to version 3.4.2 or later, which enforces authorization on the /access-tokens endpoint
Audit the t_ds_access_token table and revoke any tokens whose creation cannot be tied to a legitimate admin session
Rotate credentials and secrets referenced by data sources, tenants, and worker groups that may have been exposed

Patch Information

Apache has released Apache DolphinScheduler 3.4.2 to remediate CVE-2026-49050. The fix adds server-side authorization checks so only administrators, or the account matching the requested userId, can create access tokens. Users on any 3.x release earlier than 3.4.2 must upgrade. Refer to the Apache Thread Discussion for release details.

Workarounds

Restrict network access to the DolphinScheduler API so only trusted operators and services can reach /access-tokens
Place an authenticating reverse proxy or API gateway in front of DolphinScheduler and block /access-tokens for non-admin identities
Temporarily disable general user accounts that do not require API automation until the upgrade is complete

bash

# Example NGINX rule blocking /access-tokens for non-admin groups
location /dolphinscheduler/access-tokens {
    if ($http_x_user_role != "ADMIN") {
        return 403;
    }
    proxy_pass http://dolphinscheduler_api;
}