AI analysis
Apache DolphinScheduler versions before 3.4.3 contain a broken access control flaw (CWE-863) in the Task Group APIs, which fail to verify that the authenticated user has permission on the project tied to the target task group. An attacker needs a valid account on the scheduler, but by referencing a task group belonging to another project they can perform actions on resources they are not authorized to access. Because the flaw violates confidentiality and integrity at high impact (CVSS 3.1: 8.1), a low-privileged user could read or modify other teams' task groups, which are used to control concurrent task-slot quotas in workflows. Any organization self-hosting DolphinScheduler on a release prior to 3.4.3 is affected. No public proof-of-concept exists and the issue is not in CISA's Known Exploited Vulnerabilities catalog, so exploitation status is none known.
What to do: Upgrade to Apache DolphinScheduler 3.4.3, which fixes the missing project-authorization check in the Task Group APIs. If immediate upgrade is not possible, restrict access to the API/UI (network segmentation, VPN, reverse-proxy authentication) and audit server logs for authenticated users accessing task groups in projects outside their assigned roles. Also review task group integrity and configurations for signs of unauthorized modification prior to patching.
Affected
| Apache Software Foundation Apache DolphinScheduler | before 3.4.3 (all releases up to and including 3.4.2) |
Estimated exposure
moderatelikely a few thousand self-hosted deployments globally (subset of hundreds to low thousands internet-exposed) — DolphinScheduler is self-hosted enterprise workflow-orchestration software rather than a mass-market product, and public internet scans typically show only low thousands of exposed instances, so the affected base is estimated in the 1k–10k…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.