Vulnerability · Published Sep 18, 2026 · Assigned by VulnCheck

CVE-2026-93737Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet

Medium 6.5

In plain English

A medium-severity missing authorization in azkaban from azkaban. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 54.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution times, cron expressions, flow parameters, and notification email lists without proper authorization.

Affected products (as reported)

Vendor	Product	Versions
azkaban	azkaban	0 – through 4.0.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #3348 issue-tracking
https://github.com/azkaban/azkaban product
https://github.com/azkaban/azkaban/blob/4.0.0/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ScheduleServlet.java#L237-L262 technical-description
https://github.com/azkaban/azkaban/blob/4.0.0/azkaban-web-server/src/main/java/azkaban/webapp/servlet/ScheduleServlet.java#L403-L412 technical-description
azkaban 4.0.0 Release Notes release-notes
VulnCheck Advisory: Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet third-party-advisory