CVE-2026-32967

CVE-2026-32967: Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks

Vendor Apache Software Foundation

Product Apache DolphinScheduler

Weakness CWE-863 · Incorrect authorization

Published June 17, 2026

Last update June 17, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

Key dates

02Disclosure timeline

June 17, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-32967 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/863.html AskarLabs — CWE-863 write-up Incorrect Authorization

Related vulnerabilities

04Related CVE

CVE-2026-8789 Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion CVE-2024-13302 Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068 CVE-2026-5069 Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id' CVE-2025-5071 AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP CVE-2025-14943 Blog2Social: Social Media Auto Post & Scheduler <= 8.7.2 - Incorrect Authorization to Authenticated (Subscriber+) Sensitive Information Exposure