CVE-2026-41280

MEDIUM

Apache DolphinScheduler < 3.4.2 - Unauthorized Task Definition Deletion

Title source: manual
STIX 2.1

Description

Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue.

References (2)

Core 2
Core References
Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/06/17/7

Scores

CVSS v3 4.9
EPSS 0.0044
EPSS Percentile 35.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (3)
apache/dolphinscheduler < 3.4.2
Apache Software Foundation/Apache DolphinScheduler < 3.4.2
org.apache.dolphinscheduler/dolphinscheduler-api 0 - 3.4.2Maven
Published Jun 17, 2026
Tracked Since Jun 17, 2026