CVE-2026-93737
Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet
CVSS 4.0 7.1 HIGHCVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-93737
PublishedAzkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution times, cron expressions, flow parameters, and notification email lists without proper authorization.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-93737 · CVE overview and exploitation status
cve-program · CVE-2026-93737
- https://github.com/azkaban/azkaban/issues/3348
- https://github.com/azkaban/azkaban
- https://github.com/azkaban/azkaban/blob/4.0.0/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ScheduleServlet.java#L237-L262
- https://github.com/azkaban/azkaban/blob/4.0.0/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ScheduleServlet.java#L403-L412
- https://github.com/azkaban/azkaban/releases/tag/4.0.0
- https://www.vulncheck.com/advisories/azkaban-through-4.0.0-authorization-bypass-via-scheduleservlet
Related changes
Linked by CVE identifierNo related changes are available here.