CVE-2026-71896 Overview
CVE-2026-71896 is a broken access control vulnerability in Apache DolphinScheduler. The flaw resides in the /dolphinscheduler/users/list-all endpoint, which fails to enforce authorization checks before returning user account information. Any authenticated user can call the endpoint and retrieve account details belonging to other users, regardless of their assigned role or permissions. Successful exploitation enables account enumeration and exposes sensitive user data that can support follow-on attacks such as credential targeting or privilege escalation attempts. The issue affects all Apache DolphinScheduler releases before version 3.4.3 and is tracked under CWE-863: Incorrect Authorization.
Critical Impact
Authenticated users can enumerate every account in a DolphinScheduler deployment, exposing sensitive user information that supports lateral movement and credential-based attacks.
Affected Products
- Apache DolphinScheduler versions prior to 3.4.3
- Deployments exposing the /dolphinscheduler/users/list-all REST endpoint
- Any DolphinScheduler instance with multiple authenticated users or tenants
Discovery Timeline
- 2026-10-08 - CVE CVE-2026-71896 published to NVD
- 2026-10-08 - Disclosure posted to the Openwall OSS Security list
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2026-71896
Vulnerability Analysis
Apache DolphinScheduler is a distributed workflow scheduling platform used to orchestrate data pipelines. The REST API exposes a /dolphinscheduler/users/list-all endpoint intended for administrative use. In versions before 3.4.3, the endpoint only validates that the caller holds a valid session. It does not verify that the caller has an administrator role or the specific permission required to list user accounts.
An authenticated user with the lowest privilege level can invoke this endpoint and receive a full list of account records. The response discloses attributes that aid reconnaissance, including usernames and other profile fields maintained by the platform. Attackers can use this data to build target lists for password spraying, phishing, or further API abuse.
The root cause is a missing authorization decision in the controller or service layer handling the request. Authentication is enforced, but role-based access control (RBAC) is not applied to this specific route.
Root Cause
The endpoint relies on authentication middleware without a corresponding authorization filter. This is a classic [CWE-863] Incorrect Authorization pattern where the application confirms identity but does not evaluate whether that identity has permission to perform the action. The fix in release 3.4.3 adds the required permission check before returning user data.
Attack Vector
Exploitation requires network access to the DolphinScheduler API and a valid low-privilege account. The attacker authenticates, obtains a session token, and issues an HTTP GET request to /dolphinscheduler/users/list-all. The server returns the full user roster without evaluating the caller's role. No special tooling, user interaction, or elevated privileges are required beyond basic API access.
See the Apache mailing list disclosure for the vendor's description of the issue.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-71896
Indicators of Compromise
- HTTP GET requests to /dolphinscheduler/users/list-all originating from accounts that are not administrators.
- Unusual spikes in list-all API calls from a single session, IP address, or API token.
- Follow-on authentication attempts against usernames that were previously only visible to administrators.
Detection Strategies
- Enable access logging on the DolphinScheduler API gateway or reverse proxy and alert on calls to the /users/list-all path by non-admin principals.
- Correlate API access logs with the authenticated user's role to flag privilege-boundary violations.
- Review audit records for bulk user-data retrieval patterns that precede credential-based attacks.
Monitoring Recommendations
- Forward DolphinScheduler and web-server logs to a centralized analytics platform for retention and query.
- Baseline normal administrative API usage and alert on deviations in call frequency or source.
- Monitor downstream identity systems for password-spraying or phishing campaigns targeting enumerated usernames.
How to Mitigate CVE-2026-71896
Immediate Actions Required
- Upgrade Apache DolphinScheduler to version 3.4.3 or later, which enforces the missing authorization check.
- Rotate credentials and API tokens for any user that may have been exposed through the vulnerable endpoint.
- Restrict network exposure of the DolphinScheduler API to trusted administrative networks.
- Audit existing accounts and remove inactive or unnecessary users to reduce exposure from enumeration.
Patch Information
The Apache DolphinScheduler project resolved the issue in version 3.4.3. The patch adds the required permission validation to the /dolphinscheduler/users/list-all handler so that only authorized administrators receive user data. Upgrade details are referenced in the Apache mailing list advisory.
Workarounds
- Block or restrict access to the /dolphinscheduler/users/list-all path at a reverse proxy or web application firewall until the upgrade is applied.
- Limit DolphinScheduler account creation and enforce least-privilege roles to reduce the population of users able to abuse the endpoint.
- Place the DolphinScheduler API behind VPN or zero-trust network access controls to limit who can authenticate in the first place.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
