CVE-2026-78214 Details

A vulnerability allowing authentication bypass on Actuator endpoints has been identified in Apache DolphinScheduler versions prior to 3.4.3. This issue arises because the application determines authentication requirements by matching incoming request paths against protected Actuator paths. By sending a specially crafted request with a percent-encoded path, a remote unauthenticated attacker can manipulate the security check, causing it to overlook the request as targeting a protected endpoint. Consequently, the attacker can bypass authentication and access restricted Actuator endpoints. Exploitation of this vulnerability may reveal operational or configuration information and, depending on the application's endpoint settings, could provide access to sensitive management functions.

Users are advised to upgrade to Apache DolphinScheduler version 3.4.3 or later, which addresses this vulnerability.