CVE-2026-81569: Apache DolphinScheduler Auth Bypass

CVE-2026-81569 Overview

CVE-2026-81569 is an improper authorization vulnerability [CWE-285] in Apache DolphinScheduler. Authenticated users can reference and invoke workflows in projects they do not have permission to access. The flaw resides in the handling of sub-workflow tasks, where the system fails to verify whether the calling user has execute permission on the referenced workflow or its parent project. Exploitation allows attackers to bypass project-level authorization controls and execute workflows in unauthorized projects. The issue affects all Apache DolphinScheduler versions prior to 3.4.3.

Critical Impact

An authenticated user can execute arbitrary workflows in unauthorized projects and access resources or data available to those workflows.

Affected Products

• Apache DolphinScheduler versions before 3.4.3
• Deployments exposing multi-tenant project workflows
• Environments allowing sub-workflow task references across projects

Discovery Timeline

• 2026-09-29 - CVE-2026-81569 published to the National Vulnerability Database (NVD)
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-81569

Vulnerability Analysis

Apache DolphinScheduler organizes tasks under projects and enforces access control at the project level. The sub-workflow task type allows one workflow to invoke another workflow as a child task. The vulnerable code path accepts a target workflow identifier without checking whether the requesting user has authorization to the workflow's parent project.

An authenticated user with access to any project can craft a sub-workflow task that references a workflow located in a different project. When the parent workflow executes, the scheduler invokes the referenced sub-workflow using the scheduler's execution context rather than the user's permission scope. This exposes any workflow whose identifier is known or can be enumerated.

Root Cause

The root cause is a missing authorization check in the sub-workflow task handler. The service resolves the referenced workflow identifier and dispatches execution without validating that the invoking user possesses project-level access. This is a broken access control pattern classified under CWE-285: Improper Authorization.

Attack Vector

Exploitation requires network access to the DolphinScheduler API and a valid low-privileged account. The attacker creates a workflow in a project they legitimately control, adds a sub-workflow task referencing a workflow identifier from a target project, and triggers execution. The scheduler executes the target workflow along with any data access it performs. Sub-workflow references only affect workflow execution, not the confidentiality of stored data outside those workflows, but they can produce integrity impact through unauthorized task runs.

See the Apache Mailing List Thread and the Openwall OSS Security Discussion for the official disclosure.

Detection Methods for CVE-2026-81569

Indicators of Compromise

• Workflow execution logs showing sub-workflow invocations where the triggering user has no membership in the target project
• API requests to sub-workflow task creation endpoints referencing workflow identifiers outside the caller's project scope
• Unexpected workflow run history entries in projects with no recent legitimate activity

Detection Strategies

• Correlate user_id, source project_id, and referenced sub-workflow project_id in DolphinScheduler audit logs and alert on cross-project mismatches
• Baseline sub-workflow reference patterns per user and flag deviations that reach previously untouched projects
• Review workflow definitions containing SUB_PROCESS task types and validate the ownership chain of every referenced workflow

Monitoring Recommendations

• Forward DolphinScheduler API and scheduler logs to a centralized SIEM for cross-project authorization anomaly detection
• Monitor authentication events for accounts creating unusually broad or frequent sub-workflow tasks
• Track workflow execution counts per project and alert on execution triggered by non-member accounts

How to Mitigate CVE-2026-81569

Immediate Actions Required

• Upgrade Apache DolphinScheduler to version 3.4.3 or later, which fixes the authorization check
• Audit existing workflow definitions for sub-workflow tasks referencing workflows outside the parent project
• Rotate credentials for any service accounts whose workflows may have been executed without authorization

Patch Information

Apache has released version 3.4.3 of DolphinScheduler containing the fix. The patch adds a project-level authorization check in the sub-workflow task handler so that referenced workflows are validated against the caller's permissions before execution. Refer to the Apache Mailing List Thread for release details.

Workarounds

• Restrict DolphinScheduler API access to trusted networks and enforce least-privilege project membership for all users
• Manually review and remove any sub-workflow tasks that reference workflows across project boundaries until the upgrade is applied
• Disable workflow creation permissions for untrusted users until version 3.4.3 is deployed

# Verify the running DolphinScheduler version and upgrade if below 3.4.3
curl -s http://<dolphinscheduler-host>:12345/dolphinscheduler/actuator/info | jq '.build.version'

# Example upgrade steps (adapt to your deployment method)
# 1. Stop DolphinScheduler services
# 2. Backup metadata database and configuration files
# 3. Deploy version 3.4.3 binaries or container images
# 4. Run database migration scripts included in the release
# 5. Restart services and validate sub-workflow authorization behavior