CVE-2026-47340

MEDIUM

Apache DolphinScheduler < 3.4.2 - Unauthorized Alert Instance Access

Title source: manual

Description

Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

References (2)

Core 2

Core References

Vendor Advisory vendor-advisory

https://lists.apache.org/thread/gx6v1wjb6qg3fzksxomysspy2gw54ooc

Mailing List, Third Party Advisory

http://www.openwall.com/lists/oss-security/2026/06/17/5

Scores

CVSS v3 6.5

EPSS 0.0043

EPSS Percentile 34.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-200

Status published

Products (3)

apache/dolphinscheduler < 3.4.2

Apache Software Foundation/Apache DolphinScheduler < 3.4.2

org.apache.dolphinscheduler/dolphinscheduler-api 0 - 3.4.2Maven

Published Jun 17, 2026

Tracked Since Jun 17, 2026