CVE-2026-71897: Apache DolphinScheduler Auth Bypass Flaw

CVE-2026-71897 Overview

CVE-2026-71897 is an improper authorization vulnerability in Apache DolphinScheduler affecting versions prior to 3.4.3. The flaw resides in the batch-copy and batch-move workflow endpoints, which fail to verify that the authenticated caller holds permissions on the source project. An authenticated user can invoke these endpoints to copy or move workflows out of projects to which they should have no access. The issue is tracked under CWE-863: Incorrect Authorization. Apache has released version 3.4.3 to address the issue.

Critical Impact
Authenticated DolphinScheduler users can copy or move workflow definitions from projects they do not own, exposing workflow logic and disrupting workflow organization across tenants.

Affected Products

Apache DolphinScheduler versions before 3.4.3
batch-copy workflow API endpoint
batch-move workflow API endpoint

Discovery Timeline

2026-09-29 - CVE-2026-71897 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-71897

Vulnerability Analysis

Apache DolphinScheduler is a distributed workflow orchestration platform. It exposes REST endpoints that let users manage workflows within projects, and access to those workflows is governed by per-project permissions.

The batch-copy and batch-move endpoints accept a list of workflow identifiers and a target project. In vulnerable releases, the server validates the caller's rights on the destination project but does not verify permissions on the source project containing the referenced workflows. An authenticated user with rights to any single project can therefore reference workflow IDs from projects they cannot otherwise access.

The outcome is limited-integrity impact against unauthorized projects. An attacker can duplicate workflow definitions to a project they control, exposing business logic, credentials referenced through variables, and scheduling metadata. A move operation additionally removes the workflow from the original project, causing operational disruption.

Root Cause

The root cause is a missing authorization check on the source-project side of the batch operation. Authorization is enforced at the endpoint boundary against the target project only, satisfying [CWE-863] because access decisions are made without evaluating the caller's rights on every affected resource.

Attack Vector

Exploitation requires a valid DolphinScheduler account and network reachability to the API server. The attacker enumerates or guesses workflow identifiers belonging to other projects and issues a crafted request to batch-copy or batch-move, specifying a target project they control. No user interaction is required. Technical details are discussed on the Apache Mailing List thread and in the Openwall OSS-Security advisory.

Detection Methods for CVE-2026-71897

Indicators of Compromise

Unexpected workflow definitions appearing in projects, particularly duplicates of workflows owned by other tenants
Workflows missing from a source project without a corresponding audit entry from an authorized owner
API access logs showing calls to batch-copy or batch-move from accounts that do not own the referenced workflow IDs

Detection Strategies

Enable request logging on the DolphinScheduler API gateway and alert on batch-copy and batch-move calls where the caller's project membership does not include the source project of the referenced workflows.
Correlate workflow creation events with the requesting user's project scope using audit records from the DolphinScheduler metadata database.
Baseline the volume of batch workflow operations per user and flag statistical outliers.

Monitoring Recommendations

Forward DolphinScheduler application logs and API access logs into a centralized SIEM for cross-user analysis.
Monitor the t_ds_process_definition and related workflow tables for insert or update activity that lacks a matching authorized user session.
Track failed and successful authentication events against the DolphinScheduler UI and API for accounts exhibiting workflow enumeration behavior.

How to Mitigate CVE-2026-71897

Immediate Actions Required

Upgrade Apache DolphinScheduler to version 3.4.3 or later, which contains the authorization fix.
Audit workflow definitions in every project for unexpected additions, deletions, or ownership changes since the vulnerable version was deployed.
Rotate any credentials, tokens, or secrets referenced by workflow definitions that may have been copied to unauthorized projects.

Patch Information

Apache DolphinScheduler 3.4.3 remediates the missing authorization check on the batch-copy and batch-move endpoints. Refer to the Apache Mailing List announcement and the Openwall OSS-Security update for the official advisory text.

Workarounds

Restrict network access to the DolphinScheduler API server to trusted administrators until the upgrade to 3.4.3 is complete.
Reduce the number of accounts that hold authenticated access to the platform, and disable inactive user accounts.
Place a reverse proxy or web application firewall in front of the API that blocks POST requests to batch-copy and batch-move paths pending remediation.

bash

# Example NGINX rule to temporarily block the vulnerable endpoints
location ~* /dolphinscheduler/.*/(batch-copy|batch-move) {
    return 403;
}