Skip to content
VulniPulse
Sign in
Advisory severityMedium5.3Apache Software Foundation

Medium [CVE-2026-78214] Apache DolphinScheduler: authentication bypass vulnerability exists in the protection of Actuator endpoints

This medium-severity Apache Software Foundation advisory covers CVE-2026-78214 affecting Apache DolphinScheduler.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-78214 Source published Source updated

VulniPulse record published Record updated

CVE-2026-78214
Affected products & platforms
Apache Software FoundationUnclassified
Open source advisory

Android app · Google Play

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths.

By sending a specially crafted request containing a percent-encoded path, a remote unauthenticated attacker can cause the security check to fail to recognize the request as targeting a protected endpoint.

As a result, the attacker may bypass authentication and access otherwise restricted Actuator endpoints. Successful exploitation may expose operational or configuration information and, depending on the enabled endpoints and application configuration, allow access to sensitive management functionality.

This issue affects Apache DolphinScheduler: before 3.4.3.

Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Affected versions
  • Apache DolphinScheduler before 3.4.3

Official advisory · high-confidence parse· fetched 7 days ago·verify at source

Fixed versions
  • 3.4.3

Official advisory · high-confidence parse· fetched 7 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Official advisory · high-confidence parse· fetched 7 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.