CVE-2026-71895: Vulnerability in Apache Software Foundation Apache DolphinScheduler
Description
An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the Kubernetes API outside DolphinScheduler. The impact depends on the permissions granted to the disclosed credentials. If the kubeconfig provides cluster-admin or broadly privileged service-account access, an attacker may read Kubernetes Secrets, create pods, and establish persistent access to the cluster. This issue affects Apache DolphinScheduler: from 3.2.0 before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.
Affected software
Apache Software Foundation
Apache DolphinScheduler
pkg:maven/Apache Software Foundation/org.apache.dolphinscheduler:dolphinscheduler-apiRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-71895 is an authorization vulnerability in Apache DolphinScheduler that permits authenticated non-admin users to retrieve Kubernetes kubeconfig data used for administrator-managed cluster configuration. The exposed kubeconfig may include credentials that allow direct authentication to the Kubernetes API outside of DolphinScheduler. The impact depends on the privileges of the disclosed credentials; if they grant cluster-admin or broad service-account access, an attacker could read Kubernetes Secrets, create pods, and maintain persistent cluster access. This vulnerability affects versions >=3.1.0 and <3.4.3 and is resolved in version 3.4.3.
Potential Impact
The vulnerability allows unauthorized access to Kubernetes cluster credentials, which may enable attackers to perform privileged actions such as reading secrets, creating pods, and establishing persistent access to the cluster. The severity of impact depends on the permissions associated with the exposed kubeconfig credentials.
Mitigation Recommendations
Upgrade Apache DolphinScheduler to version 3.4.3 or later, which contains the official fix for this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-08-08T01:04:55.529Z
- State
- PUBLISHED
Threat ID: 6ac75c862cdf04f656037554
Added to database: 10/08/2026, 09:04:06 UTC
Last enriched: 10/08/2026, 09:18:18 UTC
Last updated: 10/08/2026, 09:49:09 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.