---
id: CVE-2026-32967
title: >-
  Apache DolphinScheduler: The `/v2` experimental interface lacks permission
  checks
summary: >-
  Apache DolphinScheduler: The `/v2` experimental interface lacks permission
  checks
severity: critical
cvss: 9.1
cwe:
  - CWE-863
vendor: apache
product: 'org.apache.dolphinscheduler:dolphinscheduler-api'
ecosystem: maven
affected:
  - 'org.apache.dolphinscheduler:dolphinscheduler-api < 3.4.2'
patched:
  - 'org.apache.dolphinscheduler:dolphinscheduler-api 3.4.2'
published: '2026-06-17'
updated: '2026-06-18'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-85g9-8j9g-p486'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-32967'
  - url: 'https://lists.apache.org/thread/5o5jrg1snkmrto96wg015wgbh7hyckzc'
  - url: 'http://www.openwall.com/lists/oss-security/2026/06/17/3'
  - url: 'https://github.com/advisories/GHSA-85g9-8j9g-p486'
tags:
  - ghsa
  - maven
epss: 0.00547
epssPercentile: 0.43541
ingestedAt: '2026-06-29T14:31:47.214Z'
---

## Overview

Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler.

This issue affects Apache DolphinScheduler: before 3.4.2.

Users are recommended to upgrade to version 3.4.2, which fixes the issue.

## Affected packages

- `org.apache.dolphinscheduler:dolphinscheduler-api < 3.4.2`

## Remediation

Upgrade to a patched release:

- `org.apache.dolphinscheduler:dolphinscheduler-api 3.4.2`