PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-41280 Apache Software Foundation CVE debrief

CVE-2026-41280 is a MEDIUM-severity vulnerability in Apache DolphinScheduler, affecting versions prior to 3.4.2. The issue allows users with system login privileges to delete task definitions in unauthorized projects, posing a risk to data integrity and project management. Users should upgrade to version 3.4.2, which fixes this issue. This vulnerability has a CVSS score of 4.9 and is categorized under CWE-863. The vulnerability was published on 2026-06-17T13:20:38.223Z and last modified on 2026-06-17T15:06:43.330Z.

Vendor
Apache Software Foundation
Product
Apache DolphinScheduler
CVSS
MEDIUM 4.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-17
Advisory published
2026-06-17
Advisory updated
2026-06-17

Who should care

System administrators and users of Apache DolphinScheduler versions prior to 3.4.2 should be aware of this vulnerability. Those with system login privileges are at risk of exploiting this issue, potentially leading to unauthorized project changes.

Technical summary

The CVE-2026-41280 vulnerability in Apache DolphinScheduler is caused by incorrect authorization. Users with system login privileges can delete task definitions in projects they are not authorized to access. This issue is addressed in version 3.4.2. The vulnerability's CVSS vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, indicating a high impact on integrity. It is categorized under CWE-863, 'Incorrect Authorization'.

Defensive priority

MEDIUM

Recommended defensive actions

  • Upgrade Apache DolphinScheduler to version 3.4.2 or later
  • Restrict system login privileges to only necessary users
  • Monitor project task definitions for unauthorized changes
  • Implement additional authorization checks for task definition deletion
  • Review and update access controls for project management
  • Consider implementing role-based access control (RBAC) for project management

Evidence notes

The information provided is based on the CVE record and NVD details. The vulnerability affects Apache DolphinScheduler versions prior to 3.4.2. The CVSS score and vector are provided by the NVD. The CWE classification is based on the vendor's advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-41280 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-41280

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-41280 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-41280

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.