CVE-2026-71898: Apache Software Foundation Apache Dolphinscheduler

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/{projectCode}/workflow-instances/{id} endpoint. The endpoint does not enforce the write permission required for this operation, allowing the user to make unauthorized changes to workflow instances. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Affected products

• Apache Software Foundation Apache Dolphinscheduler: before 3.4.3 (fixed in 3.4.3)

Published 2026-09-29. Last modified 2026-09-29.