CVE-2026-71899: Apache DolphinScheduler Info Disclosure

CVE-2026-71899 Overview

CVE-2026-71899 is a missing authorization vulnerability [CWE-863] in Apache DolphinScheduler. The flaw affects the query-dynamic-sub-workflows API endpoint, which fails to verify whether the authenticated user has permission to access the requested workflows. An authenticated user without access to a specific project can invoke the API with parameters referencing workflows in that project and retrieve workflow information. This results in unauthorized information disclosure across project boundaries. The issue affects Apache DolphinScheduler from version 3.2.0 before 3.4.3. Apache has released version 3.4.3 to remediate the issue.

Critical Impact

Authenticated users can bypass project-level authorization to enumerate and read workflow data belonging to projects outside their assigned scope.

Affected Products

• Apache DolphinScheduler 3.2.0
• Apache DolphinScheduler 3.3.x
• Apache DolphinScheduler versions prior to 3.4.3

Discovery Timeline

• 2026-09-29 - CVE CVE-2026-71899 published to NVD
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-71899

Vulnerability Analysis

Apache DolphinScheduler is a distributed workflow orchestration platform that organizes tasks into projects, with role-based access controls that limit which authenticated users can view or modify workflows in each project. The query-dynamic-sub-workflows API endpoint retrieves child workflow definitions referenced by a parent workflow. The endpoint validates that the caller is authenticated but does not check whether the caller has authorization on the project that owns the referenced workflows. Any authenticated tenant can therefore pass workflow identifiers belonging to arbitrary projects and receive workflow metadata in the response. The impact is limited to information disclosure, but exposed workflow definitions may include task configurations, source and target references, and orchestration logic that assist further attacks.

Root Cause

The root cause is a missing authorization check on the query-dynamic-sub-workflows handler. The controller resolves workflow identifiers directly from request parameters without confirming that the authenticated principal has read permission on the parent project. This is a classic broken access control pattern classified under CWE-863 (Incorrect Authorization).

Attack Vector

An attacker requires valid credentials to any tenant on the DolphinScheduler instance. The attacker enumerates or guesses workflow identifiers for a target project and submits them to the query-dynamic-sub-workflows API. The server returns workflow information for those identifiers regardless of the caller's project membership. No user interaction or elevated privileges are required beyond an authenticated session. Full technical context is documented in the Apache Mailing List Thread and the Openwall OSS Security Update.

Detection Methods for CVE-2026-71899

Indicators of Compromise

• Access log entries showing requests to the query-dynamic-sub-workflows API from user accounts that have no membership in the referenced project.
• Sequential or scripted enumeration of workflow identifier parameters against the API within a short time window.
• Repeated 200 OK responses to query-dynamic-sub-workflows calls originating from a single low-privilege account.

Detection Strategies

• Correlate DolphinScheduler API access logs against the project membership table to flag responses returned to users lacking authorization on the queried project.
• Baseline normal usage of the query-dynamic-sub-workflows endpoint per account and alert on volume or scope anomalies.
• Enable audit logging at the application tier and forward logs to a central analytics platform for cross-user correlation.

Monitoring Recommendations

• Ingest DolphinScheduler application and access logs into a centralized SIEM or data lake to enable historical review of API calls.
• Monitor for outbound egress of workflow definitions from the DolphinScheduler API server to unusual client addresses.
• Track authentication events for service accounts that have low-privilege project membership but issue high volumes of workflow queries.

How to Mitigate CVE-2026-71899

Immediate Actions Required

• Upgrade all Apache DolphinScheduler deployments running versions 3.2.0 through 3.4.2 to version 3.4.3.
• Audit existing user and tenant accounts to identify accounts with unnecessary access to the DolphinScheduler API.
• Review access logs for the query-dynamic-sub-workflows endpoint for the period preceding the upgrade to identify potential unauthorized access.

Patch Information

Apache has released Apache DolphinScheduler 3.4.3, which introduces the missing authorization check on the query-dynamic-sub-workflows API. Users are recommended to upgrade to version 3.4.3 as documented in the Apache Mailing List Thread.

Workarounds

• Restrict network access to the DolphinScheduler API to a limited set of trusted administrative networks until the upgrade can be applied.
• Reduce the number of authenticated users on affected instances to the minimum required for operations.
• Place a reverse proxy or web application firewall in front of DolphinScheduler and block or rate-limit requests to the query-dynamic-sub-workflows endpoint from non-administrative accounts.

# Example: block the vulnerable endpoint at an NGINX reverse proxy
# until DolphinScheduler is upgraded to 3.4.3
location ~* /dolphinscheduler/.*/query-dynamic-sub-workflows {
    allow 10.0.0.0/24;   # admin network
    deny  all;
    return 403;
}