CVE-2026-78214: Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths

Apache DolphinScheduler before 3.4.3 has an authentication bypass in how it decides whether Actuator endpoints require authentication. The check matches the incoming request path against protected Actuator paths, and a remote unauthenticated attacker can send a percent-encoded path so the request is not recognized as targeting a protected endpoint. Successful exploitation can expose operational or configuration information and, depending on which Actuator endpoints are enabled and how the application is configured, may allow access to sensitive management functionality. Anyone running an affected DolphinScheduler version with reachable Actuator endpoints is at risk. There is no known public proof of concept and no report of exploitation in the wild; the issue is not listed in CISA KEV and has not yet been scored.