Search
Find a vulnerability
Search criteria
2 vulnerabilities found for azkaban by azkaban
CVE-2026-93737 (GCVE-0-2026-93737)
Vulnerability from nvd – Published: 2026-09-18 16:04 – Updated: 2026-09-21 20:50
VLAI
EPSS
VEX
Title
Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet
Summary
Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution times, cron expressions, flow parameters, and notification email lists without proper authorization.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 16:22 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/azkaban/azkaban/issues/3348 | issue-tracking |
| https://github.com/azkaban/azkaban | product |
| https://github.com/azkaban/azkaban/blob/4.0.0/azk… | technical-description |
| https://github.com/azkaban/azkaban/blob/4.0.0/azk… | technical-description |
| https://github.com/azkaban/azkaban/releases/tag/4.0.0 | release-notes |
| https://www.vulncheck.com/advisories/azkaban-thro… | third-party-advisory |
Impacted products
Date Public
2026-06-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93737",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T16:22:52.277049Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:50:31.810Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/azkaban/azkaban",
"product": "azkaban",
"repo": "https://github.com/azkaban/azkaban",
"vendor": "azkaban",
"versions": [
{
"lessThanOrEqual": "4.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:azkaban_project:azkaban:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "George Chen"
}
],
"datePublic": "2026-06-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project\u0027s schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution times, cron expressions, flow parameters, and notification email lists without proper authorization."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T16:04:49.244Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #3348",
"tags": [
"issue-tracking"
],
"url": "https://github.com/azkaban/azkaban/issues/3348"
},
{
"tags": [
"product"
],
"url": "https://github.com/azkaban/azkaban"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/azkaban/azkaban/blob/4.0.0/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ScheduleServlet.java#L237-L262"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/azkaban/azkaban/blob/4.0.0/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ScheduleServlet.java#L403-L412"
},
{
"name": "azkaban 4.0.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/azkaban/azkaban/releases/tag/4.0.0"
},
{
"name": "VulnCheck Advisory: Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/azkaban-through-4.0.0-authorization-bypass-via-scheduleservlet"
}
],
"title": "Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93737",
"datePublished": "2026-09-18T16:04:49.244Z",
"dateReserved": "2026-09-18T15:38:23.890Z",
"dateUpdated": "2026-09-21T20:50:31.810Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93737 (GCVE-0-2026-93737)
Vulnerability from cvelistv5 – Published: 2026-09-18 16:04 – Updated: 2026-09-21 20:50
VLAI
EPSS
VEX
Title
Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet
Summary
Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution times, cron expressions, flow parameters, and notification email lists without proper authorization.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 16:22 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/azkaban/azkaban/issues/3348 | issue-tracking |
| https://github.com/azkaban/azkaban | product |
| https://github.com/azkaban/azkaban/blob/4.0.0/azk… | technical-description |
| https://github.com/azkaban/azkaban/blob/4.0.0/azk… | technical-description |
| https://github.com/azkaban/azkaban/releases/tag/4.0.0 | release-notes |
| https://www.vulncheck.com/advisories/azkaban-thro… | third-party-advisory |
Impacted products
Date Public
2026-06-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93737",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T16:22:52.277049Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:50:31.810Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/azkaban/azkaban",
"product": "azkaban",
"repo": "https://github.com/azkaban/azkaban",
"vendor": "azkaban",
"versions": [
{
"lessThanOrEqual": "4.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:azkaban_project:azkaban:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "George Chen"
}
],
"datePublic": "2026-06-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project\u0027s schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution times, cron expressions, flow parameters, and notification email lists without proper authorization."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T16:04:49.244Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #3348",
"tags": [
"issue-tracking"
],
"url": "https://github.com/azkaban/azkaban/issues/3348"
},
{
"tags": [
"product"
],
"url": "https://github.com/azkaban/azkaban"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/azkaban/azkaban/blob/4.0.0/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ScheduleServlet.java#L237-L262"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/azkaban/azkaban/blob/4.0.0/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ScheduleServlet.java#L403-L412"
},
{
"name": "azkaban 4.0.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/azkaban/azkaban/releases/tag/4.0.0"
},
{
"name": "VulnCheck Advisory: Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/azkaban-through-4.0.0-authorization-bypass-via-scheduleservlet"
}
],
"title": "Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-93737",
"datePublished": "2026-09-18T16:04:49.244Z",
"dateReserved": "2026-09-18T15:38:23.890Z",
"dateUpdated": "2026-09-21T20:50:31.810Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}