CVE-2026-66082: Apache DolphinScheduler Auth Bypass Flaw

CVE-2026-66082 Overview

CVE-2026-66082 is an authorization bypass vulnerability in Apache DolphinScheduler affecting versions prior to 3.4.3. The flaw allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances belonging to projects they do not own. Affected endpoints validate permissions against the supplied projectCode but fail to verify that the target resource actually belongs to that project. An attacker with legitimate access to one project can supply that project's code along with a resource identifier from another project to bypass access controls. The weakness maps to CWE-863: Incorrect Authorization.

Critical Impact
Authenticated users can alter workflow availability and interfere with task execution in projects outside their authorization scope, undermining data pipeline integrity.

Affected Products

Apache DolphinScheduler versions prior to 3.4.3
POST /projects/{projectCode}/schedules/{id}/online and /offline endpoints
POST /projects/{projectCode}/workflow-definition/{code}/release endpoint

Discovery Timeline

2026-10-08 - CVE-2026-66082 published to the National Vulnerability Database (NVD)
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-66082

Vulnerability Analysis

The vulnerability resides in how Apache DolphinScheduler enforces project-scoped authorization on resource mutation endpoints. The affected handlers accept a projectCode path parameter and a resource identifier such as a schedule id or workflow definition code. Authorization logic confirms the caller holds the required permission within the project referenced by projectCode. However, the handler never verifies that the resource identifier belongs to that project.

An authenticated user with permission in Project A can submit requests targeting resources in Project B by combining Project A's code with Project B's resource ID. The server authorizes the action against Project A, then applies the mutation to the resource in Project B. This allows attackers to activate, deactivate, or release workflow definitions and schedules in projects outside their authorization scope.

Successful exploitation disrupts workflow availability and task execution. Attackers can halt production data pipelines by taking schedules offline or re-enable disabled workflows to force unintended runs.

Root Cause

The root cause is a missing object-to-container ownership check. The authorization layer treats the projectCode parameter as the authoritative scope rather than deriving scope from the target resource. This is a classic broken access control pattern where the trusted boundary and the operated-upon object are decoupled.

Attack Vector

Exploitation requires network access to the DolphinScheduler API and a valid authenticated session with workflow permissions in at least one project. The attacker enumerates or guesses target resource identifiers in other projects, then issues POST requests to the vulnerable endpoints while substituting their own projectCode. No user interaction and no elevated privileges beyond standard project membership are required.

See the Apache Mailing List Thread and OpenWall OSS Security Discussion for the upstream advisory.

Detection Methods for CVE-2026-66082

Indicators of Compromise

Unexpected ONLINE or OFFLINE state transitions on workflow schedules or definitions not attributable to the owning project's users
API access logs showing a single authenticated user issuing requests to /projects/{projectCode}/... endpoints with resource IDs that do not belong to that projectCode
Audit entries where the acting user has no membership in the project that owns the mutated resource

Detection Strategies

Correlate API audit logs against the project ownership of each referenced schedule id and workflow-definition code, flagging any mismatch between projectCode and the resource's true project
Monitor for a single account making schedule or workflow release calls across an unusually broad set of projectCode values
Alert on workflow state changes that occur outside normal change windows or without a corresponding ticket or deployment

Monitoring Recommendations

Enable verbose API audit logging on all /projects/{projectCode}/schedules/ and /projects/{projectCode}/workflow-definition/ routes
Forward DolphinScheduler application and access logs to a centralized SIEM for cross-project correlation
Baseline normal per-user project activity to detect lateral enumeration across projects

How to Mitigate CVE-2026-66082

Immediate Actions Required

Upgrade Apache DolphinScheduler to version 3.4.3 or later, which contains the official fix
Review audit logs for the vulnerable endpoints since deployment to identify any unauthorized state changes
Rotate API tokens and session credentials for any accounts suspected of abusing the flaw

Patch Information

Apache has released Apache DolphinScheduler 3.4.3, which corrects the authorization logic by validating that each targeted schedule or workflow definition belongs to the projectCode in the request path. Users on any version before 3.4.3 should upgrade. Refer to the Apache Mailing List Thread for release notes.

Workarounds

Restrict access to the DolphinScheduler API to trusted network segments using firewall or reverse-proxy rules until patching is complete
Reduce the number of users granted schedule and workflow-definition permissions to the minimum required
Deploy a web application firewall rule or API gateway policy that rejects requests where the referenced resource ID is not registered to the projectCode in the URL path

bash

# Example reverse-proxy guardrail: block mutation endpoints at the perimeter
# until upgrade to 3.4.3 is complete
location ~ ^/projects/[^/]+/(schedules/[0-9]+/(online|offline)|workflow-definition/[^/]+/release)$ {
    allow 10.0.0.0/8;      # internal admin network only
    deny all;
    proxy_pass http://dolphinscheduler_backend;
}