CVE-2026-66087: Apache DolphinScheduler Auth Bypass Flaw

CVE-2026-66087 Overview

CVE-2026-66087 is an authorization bypass vulnerability in Apache DolphinScheduler, a distributed workflow scheduling platform. The flaw allows authenticated users to operate task instances in projects they are not authorized to access. Two REST endpoints under /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop and /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint fail to validate the caller's project membership. The vulnerability is tracked under CWE-863: Incorrect Authorization and affects all Apache DolphinScheduler versions prior to 3.4.3.

Critical Impact
Any authenticated DolphinScheduler user can stop or trigger savepoints on task instances belonging to projects they have no permissions on, disrupting workflows across tenant boundaries.

Affected Products

Apache DolphinScheduler versions prior to 3.4.3
The /task-instances/{taskInstanceId}/stop REST endpoint
The /task-instances/{taskInstanceId}/savepoint REST endpoint

Discovery Timeline

2026-10-08 - CVE CVE-2026-66087 published to NVD
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-66087

Vulnerability Analysis

Apache DolphinScheduler organizes workflow objects, including task instances, inside projects. Access to project resources is intended to be gated by project-level authorization checks. The two affected endpoints accept both a projectCode path parameter and a taskInstanceId. The server routes the request based on taskInstanceId but does not verify that the task instance actually belongs to a project the authenticated user can access. An attacker with a valid, low-privilege account can therefore target task instances owned by other projects, triggering stop or savepoint operations that interfere with legitimate scheduled work.

This class of flaw is categorized as CWE-863: Incorrect Authorization. It differs from authentication bypass because the user is already logged in; the server simply fails to enforce resource-level ownership. The result is horizontal privilege escalation across tenant boundaries within the same scheduler.

Root Cause

The handlers for the stop and savepoint endpoints resolve the task instance using taskInstanceId without cross-checking it against the projectCode supplied in the URL or against the user's accessible project list. The authorization layer trusts the path parameter in isolation rather than reconciling the two identifiers before executing the operation.

Attack Vector

Exploitation requires network reachability to the DolphinScheduler API and a valid authenticated session with any privilege level. The attacker enumerates or guesses taskInstanceId values and issues HTTP requests to the stop or savepoint endpoint using any projectCode they can access. The server executes the requested action against the targeted task instance regardless of whether the project code matches the instance's true owner. The impact includes termination of running jobs and generation of Flink savepoints on workflows the attacker should not touch, which disrupts integrity and availability of scheduled pipelines. See the Apache Mailing List Discussion and the Openwall OSS-Security Update for the vendor's technical description.

Detection Methods for CVE-2026-66087

Indicators of Compromise

HTTP requests to /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop or /savepoint where the authenticated user has no membership in the project identified by projectCode.
Unexpected TASK_STOP or TASK_SAVEPOINT audit events originating from low-privilege user accounts.
Workflow task instances transitioning to a stopped state without a corresponding action from an authorized project owner.

Detection Strategies

Correlate API access logs with the project membership table to flag any stop or savepoint call where the caller is not a member of the owning project.
Baseline the normal rate of task termination events per user and alert on deviations, especially from accounts that do not typically manage workflows.
Review DolphinScheduler audit logs for mismatches between the projectCode in the request URL and the project that actually owns the referenced taskInstanceId.

Monitoring Recommendations

Enable verbose API audit logging on the DolphinScheduler API server and forward logs to a central SIEM for correlation.
Alert on repeated requests from a single session that reference many distinct taskInstanceId values, which may indicate enumeration.
Monitor Flink savepoint generation events against the schedule of authorized savepoint operations.

How to Mitigate CVE-2026-66087

Immediate Actions Required

Upgrade all Apache DolphinScheduler instances to version 3.4.3 or later, which contains the authorization fix.
Audit existing user accounts and remove dormant or over-provisioned accounts that could be abused for cross-project operations.
Review API logs for the affected endpoints over the retention window to identify any historical misuse.

Patch Information

Apache has released Apache DolphinScheduler 3.4.3, which enforces project-scoped authorization on the stop and savepoint task-instance endpoints. Users on any version earlier than 3.4.3 are advised to upgrade. Refer to the Apache Mailing List Discussion for the official announcement.

Workarounds

Restrict network access to the DolphinScheduler API so that only trusted operators and services can reach the affected endpoints.
Apply a reverse-proxy or API gateway rule that blocks requests to /task-instances/{taskInstanceId}/stop and /task-instances/{taskInstanceId}/savepoint from users outside an allowlist until the patch is deployed.
Reduce the number of accounts with authenticated access to the scheduler to minimize the exploitable user base.

bash

# Example reverse-proxy rule (NGINX) to restrict the affected endpoints by source IP
location ~ ^/dolphinscheduler/projects/[^/]+/task-instances/[^/]+/(stop|savepoint)$ {
    allow 10.0.0.0/24;   # trusted operator subnet
    deny all;
    proxy_pass http://dolphinscheduler_backend;
}