CVE-2026-41280 - Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects

MEDIUM

Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects

Published Jun 17, 2026

4.9

MEDIUM

CVSS 3.1

EPSS 0.54%

Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects

This issue affects Apache DolphinScheduler versions prior to 3.4.2.

Users are recommended to upgrade to version 3.4.2, which fixes this issue.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
0	affected	<3.4.2

No remediation recorded yet.

Weaknesses (1)

CWE-863

Incorrect Authorization

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2026/06/17/7		Mailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-37581		Advisory
https://github.com/advisories/GHSA-wh3w-v6gj-fqh2		Advisory
https://lists.apache.org/thread/5bv1njp3lbbbj11y20td5yz1b4nmrtvw		vendor-advisoryMailing ListVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-41280