CVE-2026-93737

EUVD-2026-83027
Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution times, cron expressions, flow parameters, and notification email lists without proper authorization.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
azkaban_projectazkaban
𝑥
≤ 4.0.0
CNA
Common Weakness Enumeration
References
https://github.com/azkaban/azkaban
https://github.com/azkaban/azkaban/blob/4.0.0/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ScheduleServlet.java#L237-L262
https://github.com/azkaban/azkaban/blob/4.0.0/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ScheduleServlet.java#L403-L412
https://github.com/azkaban/azkaban/issues/3348
https://github.com/azkaban/azkaban/releases/tag/4.0.0
https://www.vulncheck.com/advisories/azkaban-through-4.0.0-authorization-bypass-via-scheduleservlet