Vulnerability Research

Research Summary

Vendor-confirmed outcomes: 16
Findings with CVE IDs: 9
Products / workspaces: 40

Report activity recorded from March 22 through September 2, 2026. The 16 outcomes comprise eleven identified cases and five additional vendor-confirmed cases under coordinated disclosure. Each finding is counted once, regardless of CVE assignment or timeline milestones.

Selected Vulnerability Research

Published findings describe publicly disclosed causes and impact. Cases still under coordinated disclosure show only disclosure-safe status information.

CVE-2026-59210 · Dify

Vendor-confirmed authorization boundary vulnerability

Reported May 26, 2026. Accepted with a vendor-confirmed code fix. On September 2, release-lineage review and focused regression testing confirmed that the fix shipped in 1.16.0 and remains in 1.17.0; advisory and CVE publication remain pending.

Vendor: Accepted
Remediation: Shipped since 1.16.0
CVE: Reserved
Disclosure: Advisory pending
Severity: Medium / 6.3

CVE-2026-57590 · Apache DolphinScheduler

Missing project authorization in Task Group APIs

DolphinScheduler's Task Group APIs did not properly verify whether an authenticated user could access the project associated with a target Task Group. This could allow unauthorized operations across project boundaries.

Vendor: Confirmed
Remediation: Vendor-reported fixed in 3.4.3
CVE: Published
Disclosure: Published
Severity: Apache: Low (no numeric score) · CISA-ADP: High 8.1 (CVSS 3.1)

CVE-2026-71897 · Apache DolphinScheduler

Cross-project authorization bypass in workflow batch copy and move

DolphinScheduler's batch copy and move operations did not correctly enforce project authorization for the workflows being operated on. An authenticated user could copy or move workflows from projects they were not permitted to access.

Vendor: Confirmed
Remediation: Vendor-reported fixed in 3.4.3
CVE: Published
Disclosure: Published
Severity: Apache: Moderate (no numeric score) · CISA-ADP: Medium 4.3 (CVSS 3.1)

CVE-2026-66082 · Apache DolphinScheduler

Cross-project authorization bypass in workflow release and schedules

DolphinScheduler checked permissions for the supplied project but did not verify that the target workflow or schedule belonged to it. An authenticated user with the required permissions in one project could change workflow release and schedule states in another.

Vendor: Confirmed
Remediation: Vendor-reported fixed in 3.4.3
CVE: Published
Disclosure: Published
Severity: Apache: Moderate (no numeric score) · CISA-ADP: Medium 6.5 (CVSS 3.1)

CVE-2026-66084 · Apache DolphinScheduler

Cross-project task definition update authorization bypass

DolphinScheduler's task definition update-with-upstream operation checked write permission on the supplied project without verifying that the target task definition belonged to it. An authenticated user could modify task definitions and upstream dependencies in a project they were not authorized to access.

Vendor: Confirmed
Remediation: Vendor-reported fixed in 3.4.3
CVE: Published
Disclosure: Published
Severity: Apache: Moderate (no numeric score) · CISA-ADP: High 8.1 (CVSS 3.1)

CVE-2026-73068 (listed by ToolJet GHSA) · ToolJet

Cross-workspace ToolJet DB authorization bypass

ToolJet DB checked the caller's role in their current workspace but did not verify that table-management requests targeted that same workspace. A workspace admin could create or delete tables, and view table metadata, in another workspace.

Vendor: Accepted
Remediation: Source-verified in v3.20.207-lts
CVE: GHSA lists 73068
Disclosure: Published
Severity: ToolJet GHSA: Moderate 6.8 (CVSS 3.1)

CVE pending · ToolJet

Vendor-accepted security report

Reported June 30, 2026. Accepted September 2, 2026, with reporter credit. The advisory remains private; remediation, fixed-release metadata, CVE assignment, public severity, and advisory publication remain pending.

Vendor: Accepted
Remediation: Pending
CVE: Pending
Disclosure: Advisory pending
Severity: Pending publication

CVE-2026-81841 · Grafana

Paused shared dashboard access tokens still expose data source configuration

Grafana did not consistently enforce shared-dashboard pause state when returning frontend configuration. A holder of a previously valid shared link could continue reading referenced data source configuration without signing in, despite normal dashboard access being blocked.

Vendor: Accepted
Remediation: Vendor-listed fixes: 12.4.12, 13.0.10, 13.1.7, 13.2.3
CVE: Published
Disclosure: Published
Severity: Grafana advisory: Medium 5.3 (CVSS 3.1)
Bounty: $656

CVE-2026-94609 · authentik

Privilege escalation via delegated group and user management

An account with delegated permission to manage a single group or user could grant superuser status to any account or assign an existing role to a group without the required permissions. The issue affects deployments that delegate these tasks to non-administrators.

Vendor: Validated
Remediation: Vendor-listed patched releases
CVE: Published
Disclosure: Published
Severity: High / 8.8 (CVSS 3.1)

CVE-2026-84677 · Jenkins

Stored XSS vulnerability in update-center2

update-center2 did not escape plugin-supplied names, descriptions, or version metadata when rendering plugin download index pages. An attacker able to provide a plugin for hosting could inject script into those pages.

Vendor: Confirmed
Remediation: Released in 3.18.4
CVE: Published
Disclosure: Published
Severity: Medium / 5.4

Proton

Vendor-recognized vulnerability report

Reported a vulnerability to Proton and was listed on its official Security Contributors page. Technical details remain private.

Vendor: Accepted
Bounty: USD 200 received

Other Coordinated Outcomes

Five additional reports were accepted or otherwise confirmed by their vendors. Three have numeric reported or vendor-confirmed scores, one has a vendor-rated Moderate severity without a numeric score, and one awaits a final vendor rating. Product and technical details remain private during coordinated remediation and publication.

High 7.1
Medium 6.1
Medium 5.7
Moderate Score not published
Vendor rating Pending for one outcome

Disclosure Timeline

Selected safely identifiable milestones from 2026, shown in reverse chronological order.

October 8 Advisory published

Apache DolphinScheduler

CVE-2026-66084 · Apache: Moderate · CISA-ADP: High 8.1 (CVSS 3.1)
October 8 Advisory published

Apache DolphinScheduler

CVE-2026-66082 · Apache: Moderate · CISA-ADP: Medium 6.5 (CVSS 3.1)
September 29 Advisory published

Apache DolphinScheduler

CVE-2026-71897 · Apache: Moderate · CISA-ADP: Medium 4.3 (CVSS 3.1)
September 29 Advisory published

Grafana

CVE-2026-81841 · Fixes released · Grafana advisory: Medium 5.3 (CVSS 3.1)
September 24 Advisory published

Apache DolphinScheduler

CVE-2026-57590 · Remediation verification unresolved
September 9 Advisory published

authentik

CVE-2026-94609 · High 8.8
September 2 Advisory published

Jenkins

CVE-2026-84677 · Released in 3.18.4 · Medium 5.4
September 2 Vendor accepted

ToolJet

CVE, remediation, and advisory publication pending
September 2 Fix release verified

Dify

CVE-2026-59210 · Shipped since 1.16.0 · Advisory pending
August 28 Vendor validated

authentik

Original report consolidated · Current status: Advisory published
August 26 Accepted

Grafana

Intigriti: Medium 4.3 · $656 bounty
August 7 Advisory published

ToolJet

GHSA-2jhv-482p-4php · Moderate 6.8
August 4 Fix released

ToolJet

v3.20.207-lts · Remediation source-verified
June 29 Report submitted

Apache DolphinScheduler

CVE-2026-57590 · Current status: Published
June 29 Report submitted

Apache DolphinScheduler

CVE-2026-66082 · Current status: Published
May 26 Report submitted

Dify

CVE-2026-59210 · Current status: Accepted · Shipped since 1.16.0

Programs & Research Coverage

Programs: OSS projects, GitHub Security Advisories, ASF Security, Jenkins Security Jira, Intigriti, HackerOne, and Wordfence
Research focus: Authorization boundaries, tenant isolation, credential handling, workflow execution, plugin surfaces, and API surfaces