Apache DolphinScheduler versions prior to 3.4.3 contain an authentication bypass vulnerability affecting the protection of Actuator endpoints. The application determines if authentication is required by matching the incoming request path against protected Actuator paths. However, by using a specially crafted request with a percent-encoded path, an attacker can cause the security check to fail to recognize the request as targeting a protected endpoint. This allows the attacker to bypass authentication and access restricted Actuator endpoints, potentially exposing operational or configuration data and sensitive management features depending on the configuration.

Successful exploitation allows a remote unauthenticated attacker to bypass authentication controls on Actuator endpoints. This can lead to unauthorized access to operational or configuration information and, depending on enabled endpoints and application settings, access to sensitive management functionality. No known exploits in the wild have been reported.

Users should upgrade Apache DolphinScheduler to version 3.4.3 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory.