Is org.apache.dolphinscheduler:dolphinscheduler-api affected by CVE-2026-41280?

Maven org.apache.dolphinscheduler:dolphinscheduler-api is affected in <3.4.2.

Is CVE-2026-41280 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.6%.

← All vulnerabilities

MEDIUMSupply chain

CVE-2026-41280

Q: Is CVE-2026-41280 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.6%.

Maven · org.apache.dolphinscheduler:dolphinscheduler-api

Summary

Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects

References

https://nvd.nist.gov/vuln/detail/CVE-2026-41280
https://github.com/apache/dolphinscheduler
https://lists.apache.org/thread/5bv1njp3lbbbj11y20td5yz1b4nmrtvw

Related vulnerabilities

All Supply chain →

HIGHCVE-2026-52801
Gogs has the ability to import local repositories via Mirror Settings
HIGHCVE-2026-52800
Gogs Vulnerable to CSRF Leading to Organization Owner Takeover
HIGHCVE-2026-52799
Gogs Missing Authorization in Attachment Download
HIGHCVE-2026-52798
Gogs has Stored XSS in `.ipynb` Preview
MEDIUMCVE-2026-50179
@actual-app/web has CSV Formula Injection in Transaction Export via Imported Payee/Notes Fields
HIGHCVE-2026-54353
@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation