CVE-2026-32967: Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks
Incorrect Authorization vulnerability of /v2 experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.
Published Jun 17, 2026 · Updated Jun 18, 2026
Affected packages
org.apache.dolphinscheduler:dolphinscheduler-api
- Ecosystem
- Maven
- Affected
- < 3.4.2
- Fixed in
- 3.4.2
- Check
mvn dependency:tree -Dincludes=org.apache.dolphinscheduler:dolphinscheduler-api
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Incorrect Authorization vulnerability of /v2 experimental interface in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology