CVE-2026-47340: medium-severity vulnerability in Apache DolphinScheduler
Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.
Published
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.5%
exploitation probability
0.5%top 56% of all CVEs
observed exploitation
nono source reports it
Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Apache Software Foundation · Apache DolphinSchedulerRelated CVEs — Apache DolphinScheduler
In the same product, most dangerous first.
CVE-2024-30188HIGHApache DolphinScheduler: Resource File Read And Write VulnerabilityEPSS 6.0%CVE-2022-45462CRITICALApache DolphinScheduler prior to 2.0.5 have command execution vulnerabilityEPSS 2.8%CVE-2022-45875CRITICALApache DolphinScheduler: Remote command execution Vulnerability in script alert pluginEPSS 2.5%CVE-2023-49109CRITICALRemote Code Execution in Apache DolphinschedulerEPSS 2.3%CVE-2024-43202CRITICALApache DolphinScheduler: Remote Code Execution VulnerabilityEPSS 2.1%CVE-2022-25598—Apache DolphinScheduler user registration is vulnerable to ReDoS attacksEPSS 2.0%