CVE-2026-71899

Published 29 September 2026 · tracked since 30 September 2026

Description

A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a sp

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-129267 LOW 3.5
• CVE-2026-127115 MEDIUM 5.4
• CVE-2026-120687 HIGH 7.2
• CVE-2026-116753 HIGH 7.2
• CVE-2026-110531 MEDIUM 6.4
• CVE-2026-19907 CRITICAL 9.8
• CVE-2026-18053 HIGH 8.8
• CVE-2026-129433 CRITICAL 9.9
• CVE-2026-129254 MEDIUM 4.3
• CVE-2026-120522 CRITICAL 9.8

→ Open the live CVE board · all tools