PT-2026-34873 · Apache · Apache Dolphinscheduler

Jihang Yu · Published 2026-04-24 · Updated 2026-04-28 · CVE-2026-23902

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions prior to 3.4.1

Description An incorrect authorization issue allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.

Recommendations Upgrade to version 3.4.1.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-23902

GHSA-72MV-WWVM-VGP5

Affected Products

Apache Dolphinscheduler

References · 7

• https://osv.dev/vulnerability/GHSA-72mv-wwvm-vgp5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23902 · Security Note
• https://lists.apache.org/thread/hy4ntb2gys8150zfmnxhsd5ph0hoh7s9 · Vendor Advisory
• https://github.com/apache/dolphinscheduler · Note
• https://twitter.com/oss_security/status/2048945181538365835 · Twitter Post
• https://twitter.com/CVEnew/status/2048099296910639377 · Twitter Post
• http://openwall.com/lists/oss-security/2026/04/24/1 · Note