CVE-2026-66084: Apache DolphinScheduler Auth Bypass Flaw

CVE-2026-66084 Overview

CVE-2026-66084 is an authorization bypass vulnerability in Apache DolphinScheduler, an open-source distributed workflow scheduling platform. The flaw exists in the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint. The endpoint fails to verify that the task definition identified by code belongs to the project specified by projectCode. Authenticated users can supply a projectCode they are authorized to access along with a task definition code from a different project. This bypasses project-level access restrictions and permits modification of task definitions and their upstream dependencies in unauthorized projects. The issue affects Apache DolphinScheduler versions prior to 3.4.3 and is categorized under [CWE-863: Incorrect Authorization].

Critical Impact
Authenticated attackers can modify task definitions and upstream dependencies in projects they do not own, compromising workflow integrity and disrupting scheduled task execution across tenants.

Affected Products

Apache DolphinScheduler versions before 3.4.3
Apache DolphinScheduler task-definition REST API component
Multi-tenant DolphinScheduler deployments sharing a single authentication realm

Discovery Timeline

2026-10-08 - CVE-2026-66084 published to NVD
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-66084

Vulnerability Analysis

Apache DolphinScheduler enforces project-based access control to isolate workflows and task definitions between tenants and teams. The with-upstream task-definition endpoint accepts both a projectCode path parameter and a task definition code path parameter. The server validates the caller's membership in the project referenced by projectCode but does not confirm that the supplied task definition code actually belongs to that project. An attacker with low-privileged access to any project can therefore target task definitions in unrelated projects.

Successful exploitation permits modification of the target task definition and its upstream dependencies. In workflow orchestration platforms, altering a task definition can change command execution, data sources, scheduling parameters, or dependency chains. This directly impacts workflow integrity and the correctness of downstream data pipelines.

Root Cause

The root cause is a missing cross-reference check between the resource identifier (code) and its parent container (projectCode). The authorization layer treats project membership as sufficient without verifying resource ownership within that project. This is a classic [CWE-863] broken access control pattern in which the server trusts object identifiers supplied by the client.

Attack Vector

Exploitation requires network access to the DolphinScheduler API and valid credentials for at least one project. The attacker crafts a PUT request to the with-upstream endpoint, substituting a task definition code enumerated or guessed from another project while retaining a projectCode they legitimately control. No user interaction is required. The server processes the request and applies the modification to the foreign task definition.

The vulnerability is described in prose only; no public proof-of-concept code has been released. See the Apache Thread Discussion and the Openwall OSS Security Update for the vendor advisory details.

Detection Methods for CVE-2026-66084

Indicators of Compromise

Unexpected modifications to task definitions attributed to user accounts without a prior history of editing those workflows.
API access logs showing PUT requests to /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream where the code value does not belong to the referenced projectCode.
Audit entries showing upstream dependency changes immediately followed by abnormal workflow execution patterns or failures.

Detection Strategies

Correlate task-definition update events with the authenticated user's project memberships and flag mismatches between the modified resource's owning project and the user's authorized projects.
Enable verbose API logging on the DolphinScheduler API server and parse requests to the task-definition endpoints for cross-project parameter combinations.
Baseline normal editing patterns per user and alert on sudden spikes in task-definition PUT operations.

Monitoring Recommendations

Forward DolphinScheduler application and access logs to a centralized logging platform for retention and query.
Monitor the master and API server components for unauthorized configuration drift in t_ds_task_definition and related tables.
Track workflow execution anomalies, including unexpected command strings, altered SQL, or new upstream dependencies.

How to Mitigate CVE-2026-66084

Immediate Actions Required

Upgrade Apache DolphinScheduler to version 3.4.3 or later, which contains the authorization check fix.
Audit all task definitions and upstream dependencies for unauthorized modifications since the vulnerable version was deployed.
Rotate credentials for any low-privileged DolphinScheduler accounts that may have been used to probe cross-project resources.

Patch Information

The Apache DolphinScheduler project resolved the issue in version 3.4.3. The fix adds a validation step that confirms the task definition identified by code belongs to the project identified by projectCode before any modification is applied. Refer to the Apache Thread Discussion for the official advisory.

Workarounds

Restrict network access to the DolphinScheduler API to trusted administrative networks until patching is complete.
Reduce the number of authenticated users with project access to the minimum required for operations.
Place a reverse proxy or API gateway in front of DolphinScheduler to log and inspect requests to the task-definition/{code}/with-upstream endpoint.

bash

# Verify installed DolphinScheduler version and plan upgrade to 3.4.3
./bin/dolphinscheduler-daemon.sh status api-server
grep -r "version" ./conf/ | grep -i dolphin
# Follow the official upgrade guide to move to 3.4.3 or later