CVE-2026-41280

Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue.

Score

CVSS 3.1 4.9 Medium

Status

Analyzed - security@apache.org

Published

2026-06-17

Last modified

2026-10-26

Weaknesses

CWE-863

Affected products

• Dolphinscheduler (Apache)
• Apache Dolphinscheduler (Apache Software Foundation)

References

• https://lists.apache.org/thread/5bv1njp3lbbbj11y20td5yz1b4nmrtvw
• http://www.openwall.com/lists/oss-security/2026/06/17/7