CVE-2026-57590: Apache DolphinScheduler Auth Bypass Flaw

CVE-2026-57590 Overview

CVE-2026-57590 is a missing authorization vulnerability [CWE-863] in the Task Group APIs of Apache DolphinScheduler. The affected endpoints fail to verify whether the authenticated user has permission to access the project associated with the target Task Group. An authenticated attacker with low privileges can interact with Task Groups belonging to projects outside their authorization scope. The flaw affects all versions of Apache DolphinScheduler before 3.4.3. Apache has released version 3.4.3 to address the issue.

Critical Impact
Authenticated users can read and modify Task Group resources across project boundaries, breaking tenant isolation in multi-project DolphinScheduler deployments.

Affected Products

Apache DolphinScheduler versions prior to 3.4.3
Apache DolphinScheduler Task Group API endpoints
Multi-tenant DolphinScheduler deployments with project-level access controls

Discovery Timeline

2026-09-24 - CVE CVE-2026-57590 published to NVD
2026-09-24 - Apache security advisory disclosed via Apache Mailing List Thread and Openwall OSS Security Update
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-57590

Vulnerability Analysis

Apache DolphinScheduler is a distributed workflow orchestration platform. Task Groups allow administrators to limit concurrent task execution within a project. The Task Group APIs expose operations for creating, listing, updating, and deleting these resources.

The vulnerable endpoints authenticate the caller but do not evaluate whether the caller has permission on the project that owns the Task Group. An attacker with valid, low-privilege credentials can therefore target Task Groups owned by projects they do not administer. The result is a confidentiality and integrity breach across project boundaries within the same DolphinScheduler instance.

The issue is classified as Incorrect Authorization [CWE-863]. The CVSS vector reflects network-reachable exploitation requiring only low privileges and no user interaction.

Root Cause

The Task Group API handlers perform authentication checks but omit project-scope authorization checks. In correctly scoped endpoints, DolphinScheduler validates that the requesting user has a role granting access to the project referenced by the resource. The Task Group handlers skip this validation, trusting the resource identifier supplied in the request without binding it to the caller's project permissions.

Attack Vector

Exploitation requires an authenticated session on the DolphinScheduler API, which is network-reachable. An attacker enumerates or guesses Task Group identifiers and invokes the affected Task Group endpoints with those identifiers. Because the server does not cross-check the project owner against the caller's permissions, the request succeeds. The attacker can disclose Task Group configuration, modify concurrency limits, or delete Task Groups in projects they do not control, disrupting workflow scheduling for other tenants.

No verified public exploit code is available. Technical details are referenced in the Apache Mailing List Thread.

Detection Methods for CVE-2026-57590

Indicators of Compromise

Access log entries where a low-privilege user invokes Task Group API paths referencing project identifiers outside their assigned projects.
Unexpected creation, modification, or deletion events in DolphinScheduler audit logs for Task Group resources.
API traffic to Task Group endpoints originating from accounts that have never previously interacted with the affected projects.

Detection Strategies

Correlate authenticated API requests against the user-to-project assignment table and alert when a Task Group request targets a project the user is not assigned to.
Baseline normal Task Group API usage per user and flag deviations such as sudden enumeration of Task Group IDs.
Review DolphinScheduler application logs for 2xx responses to Task Group endpoints that should have returned 403 under correct authorization.

Monitoring Recommendations

Enable DolphinScheduler API access logging and forward logs to a centralized SIEM for retention and query.
Monitor Task Group create, update, and delete operations and require review when invoked by non-admin accounts.
Alert on sequential ID enumeration patterns against /task-group/* endpoints.

How to Mitigate CVE-2026-57590

Immediate Actions Required

Upgrade Apache DolphinScheduler to version 3.4.3 or later, which contains the authorization fix.
Audit existing Task Group resources for unexpected changes made before patching.
Rotate credentials for any low-privilege DolphinScheduler accounts that may have been abused.
Restrict network reachability of the DolphinScheduler API to trusted administrative networks.

Patch Information

Apache DolphinScheduler 3.4.3 resolves CVE-2026-57590 by adding project-scope authorization checks to the Task Group APIs. Users should upgrade directly from the official Apache DolphinScheduler release channel. Patch details are published through the Apache Mailing List Thread and the Openwall OSS Security Update.

Workarounds

Restrict access to the DolphinScheduler web and API interfaces using network ACLs or a reverse proxy that enforces IP allowlisting.
Limit the number of accounts with API access and remove unused low-privilege users until the upgrade is complete.
Place an authorization-aware API gateway in front of DolphinScheduler to validate project ownership on Task Group endpoints as a compensating control.

bash

# Upgrade example for a standalone DolphinScheduler deployment
# Stop the running services
./bin/dolphinscheduler-daemon.sh stop all

# Back up the configuration and metadata database before upgrading
cp -r conf conf.backup.$(date +%F)

# Replace the installation with the 3.4.3 release package, then restart
./bin/dolphinscheduler-daemon.sh start all