PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-32967 Apache Software Foundation CVE debrief

CVE-2026-32967 is a critical Incorrect Authorization vulnerability in Apache DolphinScheduler's `/v2` experimental interface. The issue affects all versions before 3.4.2 and has a CVSS score of 9.1. Users should upgrade to version 3.4.2 to fix the issue. This vulnerability allows unauthorized access, potentially leading to data breaches or system compromise. Organizations using Apache DolphinScheduler should prioritize this update. The vulnerability was publicly disclosed on June 17, 2026.

Vendor
Apache Software Foundation
Product
Apache DolphinScheduler
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-17
Advisory published
2026-06-17
Advisory updated
2026-06-17

Who should care

Apache DolphinScheduler users, administrators, and security teams should be aware of this critical vulnerability. Upgrading to version 3.4.2 is recommended to prevent potential unauthorized access and data breaches.

Technical summary

The CVE-2026-32967 vulnerability is caused by incorrect authorization in the `/v2` experimental interface of Apache DolphinScheduler. This issue allows attackers to bypass authorization, potentially leading to unauthorized access and data breaches. The vulnerability has a CVSS score of 9.1, indicating critical severity. The affected versions are all before 3.4.2, and users are recommended to upgrade to this version to fix the issue.

Defensive priority

high

Recommended defensive actions

  • Upgrade Apache DolphinScheduler to version 3.4.2 or later
  • Review and restrict access to the `/v2` experimental interface
  • Implement additional authorization and authentication mechanisms
  • Monitor system logs for suspicious activity
  • Conduct regular security audits and vulnerability assessments

Evidence notes

The information provided is based on the official CVE record and NVD details. The vulnerability was publicly disclosed on June 17, 2026, and the recommended fix is to upgrade to Apache DolphinScheduler version 3.4.2.

Official resources

public