CVE-2026-71898: Apache DolphinScheduler Auth Bypass Flaw

CVE-2026-71898 Overview

CVE-2026-71898 is a broken access control vulnerability in Apache DolphinScheduler. The PUT /projects/{projectCode}/workflow-instances/{id} endpoint fails to enforce write permission checks. An authenticated user holding only read permission on a project can modify workflow instances within that project. The flaw is classified as [CWE-863: Incorrect Authorization]. All Apache DolphinScheduler versions before 3.4.3 are affected. The project maintainers released version 3.4.3 to correct the authorization logic.

Critical Impact

Read-only users can tamper with workflow instances, undermining data integrity and workflow governance in shared DolphinScheduler projects.

Affected Products

• Apache DolphinScheduler versions prior to 3.4.3
• Deployments exposing the /projects/{projectCode}/workflow-instances/{id} REST endpoint
• Multi-tenant DolphinScheduler installations that rely on project-level role separation

Discovery Timeline

• 2026-09-29 - CVE-2026-71898 published to NVD
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-71898

Vulnerability Analysis

Apache DolphinScheduler enforces a permission model that distinguishes between read and write access at the project scope. The PUT /projects/{projectCode}/workflow-instances/{id} endpoint validates that the caller can access the project but does not confirm the caller holds write permission. As a result, any authenticated user with read-only project access can issue update requests against workflow instances they should only be able to view.

The consequence is unauthorized modification of workflow instance state. Attackers can alter runtime parameters, tamper with execution records, or disrupt scheduled orchestration used by data engineering teams. Confidentiality is not directly affected, but integrity of orchestration data and downstream data pipelines can be compromised.

Root Cause

The endpoint handler omits the authorization check that verifies the caller's write privilege for the target project. The check that gates read access is present, but the corresponding write-permission enforcement for update operations is missing. This aligns with [CWE-863], where access decisions are made using an insufficient or incorrect check.

Attack Vector

Exploitation requires network access to the DolphinScheduler API and a valid authenticated session with at least read permission on the target project. The attacker sends an HTTP PUT request to /projects/{projectCode}/workflow-instances/{id} with a modified workflow instance payload. The server accepts and applies the change without validating write authorization. No user interaction is required beyond the initial authenticated session.

Refer to the Apache Mailing List Thread and the Openwall OSS-Security Update for the vendor advisory.

Detection Methods for CVE-2026-71898

Indicators of Compromise

• Unexpected PUT requests to /projects/{projectCode}/workflow-instances/{id} originating from accounts assigned only read roles
• Workflow instance modification events in DolphinScheduler audit logs that do not match approved change windows
• Sudden changes to workflow instance parameters, states, or execution history without corresponding administrator activity

Detection Strategies

• Correlate DolphinScheduler API access logs with the project role assignments in the user permission table
• Alert when accounts with read-only project roles issue HTTP methods other than GET against project scoped endpoints
• Baseline normal workflow instance update volume per user and flag statistical outliers

Monitoring Recommendations

• Forward DolphinScheduler application and audit logs to a centralized log store for retention and correlation
• Enable request logging at the reverse proxy or API gateway fronting DolphinScheduler to capture full HTTP method and path data
• Review authentication events and API activity for service accounts that should never invoke write operations

How to Mitigate CVE-2026-71898

Immediate Actions Required

• Upgrade Apache DolphinScheduler to version 3.4.3 or later, which enforces the missing write permission check
• Audit project role assignments and remove unnecessary access grants to reduce the population of authenticated users who could abuse the flaw
• Review workflow instance change history to identify unauthorized modifications made by read-only accounts

Patch Information

Apache DolphinScheduler 3.4.3 contains the fix for CVE-2026-71898. The release adds the required write authorization check to the workflow instance update endpoint. Deployment details and upgrade guidance are available in the Apache Mailing List Thread.

Workarounds

• Restrict network access to the DolphinScheduler API using a reverse proxy or API gateway that blocks PUT requests to the affected endpoint for non-administrative users
• Temporarily revoke project access for accounts that only require read visibility until the upgrade is complete
• Place DolphinScheduler behind an authenticated ingress that enforces role-based method restrictions

# Example NGINX rule blocking PUT to the vulnerable endpoint pending upgrade
location ~ ^/dolphinscheduler/projects/[^/]+/workflow-instances/[^/]+$ {
    limit_except GET {
        deny all;
    }
    proxy_pass http://dolphinscheduler_backend;
}