CVE-2026-32967 is an incorrect authorization flaw in the experimental /v2 interface of Apache DolphinScheduler, scored CVSS 9.1 by NVD. The interface lacks permission checks. Versions before 3.4.2 are affected, and the Apache project recommends upgrading to 3.4.2. The record gives no further technical detail, so rely on the vendor upgrade.
What's affected
The Apache announcement on oss-security lists Apache DolphinScheduler (the dolphinscheduler-api package) before 3.4.2 as affected and recommends 3.4.2. Apache rates it moderate. NVD scores it 9.1.
The announcement says the /v2 experimental interface lacks permission checks. It does not describe more detail than that.
How to check if you're exposed
Find the version from the API jar name:
ls libs | grep dolphinscheduler-api
Compare it with 3.4.2. Then check whether the /v2 routes are reachable from users or networks that should not use them, for example through your reverse proxy configuration.
What to do now
- Upgrade DolphinScheduler to 3.4.2 or later.
- Until then, block the /v2 path at your reverse proxy if nothing you run depends on it.
- Review user accounts and their roles.
- Check audit logs for use of the /v2 interface.
- Apply the same upgrade for CVE-2026-32966, which was fixed in the same release.
Why it matters
The class is CWE-863, incorrect authorization. Experimental interfaces are a common place for this bug, because they ship quickly and sometimes miss the permission layer that older routes have.
Blocking unused experimental routes at the edge is cheap and worth doing in general. The record's KEV flag is false.
Quick check
Can I block the v2 path as a workaround?
The announcement does not list workarounds. Blocking an unused path at the proxy is a sensible hardening step, but upgrading is the fix.
Is this the same bug as CVE-2026-32966?
No. That one is a missing check on the DataSource API. This one concerns the experimental v2 interface. Both are fixed in 3.4.2.
Sources
Last reviewed: 19 October 2026.
