Vulnerability Description
Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbitrary project and flow identifiers to retrieve sensitive schedule details including execution times, cron expressions, flow parameters, and notification email lists without proper authorization.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/azkaban/azkaban
- https://github.com/azkaban/azkaban/blob/4.0.0/azkaban-web-server/src/main/java/a
- https://github.com/azkaban/azkaban/blob/4.0.0/azkaban-web-server/src/main/java/a
- https://github.com/azkaban/azkaban/issues/3348
- https://github.com/azkaban/azkaban/releases/tag/4.0.0
- https://www.vulncheck.com/advisories/azkaban-through-4.0.0-authorization-bypass-
FAQ
What is CVE-2026-93737?
CVE-2026-93737 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule configuration. Attackers can supply arbit...
How severe is CVE-2026-93737?
CVE-2026-93737 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-93737?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.