PatchSiren cyber security CVE debrief

CVE-2026-66087 Apache Software Foundation CVE debrief

CVE-2026-66087 is an authorization bypass vulnerability in Apache DolphinScheduler that allows authenticated users to operate task instances in projects they are not authorized to access through the /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop and /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint endpoints. This issue affects Apache DolphinScheduler versions before 3.4.3. Defenders managing Apache DolphinScheduler deployments should assess exposure and prioritize upgrading to version 3.4.3. The vulnerability requires verification of exposure and remediation priority.

Vendor: Apache Software Foundation
Product: Apache DolphinScheduler
CVSS: Unknown
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-08
Original CVE updated: 2026-10-08
Advisory published: 2026-10-08
Advisory updated: 2026-10-08

Who should care

Defenders managing Apache DolphinScheduler deployments should assess exposure and prioritize upgrading to version 3.4.3. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and implement necessary mitigations. The vulnerability affects versions before 3.4.3 and requires verification of exposure and remediation priority.

Why it matters

CVE-2026-66087 is an authorization bypass vulnerability in Apache DolphinScheduler that allows authenticated users to operate task instances in projects they are not authorized to access. Defenders managing Apache DolphinScheduler deployments should assess exposure and prioritize upgrading to version 3.4.3. The vulnerability affects versions before 3.4.3 and requires verification of exposure and remediation priority.

Verify exposure and upgrade to version 3.4.3 if vulnerable
Monitor task instance operations for unauthorized access
Assess and implement compensating controls if upgrade is not feasible

Technical summary

Apache DolphinScheduler has an authorization bypass vulnerability in the task instance stop/savepoint endpoint, affecting versions before 3.4.3. The vulnerability allows authenticated users to operate task instances in projects they are not authorized to access. Defenders should prioritize verifying exposure and upgrading to version 3.4.3 if using Apache DolphinScheduler before 3.4.3. The issue requires verification of exposure and remediation priority, and defenders should assess and implement compensating controls if upgrade is not feasible.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to version 3.4.3 if using Apache DolphinScheduler before 3.4.3.

Recommended defensive actions

Verify if using Apache DolphinScheduler versions before 3.4.3
Upgrade to version 3.4.3 if vulnerable
Monitor task instance operations for unauthorized access
Review compensating controls for exposed systems while remediation is scheduled and verified
Check relevant monitoring, detection, and logs for exposed assets that need extra review
Track exceptions, retest remediated assets, and close the item only after evidence is documented
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the authorization bypass vulnerability in Apache DolphinScheduler. The NVD entry is currently empty. Defenders should verify if using Apache DolphinScheduler versions before 3.4.3 and assess exposure. The vulnerability allows authenticated users to operate task instances in unauthorized projects.

Sources and references

Verified primary and authoritative sources

CVE-2026-66087 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-66087

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-66087 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-66087

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoi
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/66xxx/CVE-2026-66087.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://lists.apache.org/thread.html/pghhb42sbyv5dhx6clcj4hllxnh7c0dn

Supplemental source - vendor-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.