CVE-2026-23902

—

CVSS 3.1

8.1 high

EPSS

<1%p38

Published

Apr 24, 2026 (Apr 24, 2026)

Modified

Jun 17, 2026

Description

Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution. This issue affects Apache DolphinScheduler versions prior to 3.4.1. Users are recommended to upgrade to version 3.4.1, which fixes this issue.

Vendors: apache
Products: dolphinscheduler
Weakness: CWE-863
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.