Threats affecting pkg:maven/Apache Software Foundation/org.apache.dolphinscheduler:dolphinscheduler-api

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before returning user account information. As a result, an authenticated user can access account information they are not authorized to view. Successful exploitation may expose sensitive user information and facilitate account enumeration. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the Kubernetes API outside DolphinScheduler. The impact depends on the permissions granted to the disclosed credentials. If the kubeconfig provides cluster-admin or broadly privileged service-account access, an attacker may read Kubernetes Secrets, create pods, and establish persistent access to the cluster. This issue affects Apache DolphinScheduler: from 3.2.0 before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls and return sensitive connection information, including data source passwords. As a result, an authenticated user without permission to access a data source can retrieve its connection details and credentials. Successful exploitation exposes sensitive data source information and may enable unauthorized access to the underlying databases using the disclosed credentials. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

CVE-2026-66087 is an authorization bypass vulnerability in Apache DolphinScheduler that allows authenticated users to operate task instances in projects they are not authorized to access. The vulnerability affects versions before 3.4.3 and can be exploited via specific API endpoints related to stopping task instances and saving task instance savepoints. The issue is fixed in version 3.4.3.

CVE-2026-66084 is an authorization bypass vulnerability in Apache DolphinScheduler before version 3.4.3. It allows authenticated users to modify task definitions in projects they are not authorized to access by exploiting a flaw in the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint. The endpoint does not verify that the task definition code belongs to the specified project, enabling unauthorized modification of task definitions and their upstream dependencies. This can compromise workflow integrity and disrupt task execution in unauthorized projects. The issue is fixed in version 3.4.3.

CVE-2026-66082 is an authorization bypass vulnerability in Apache DolphinScheduler before version 3.4.3. Authenticated users with permissions in one project can perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects by exploiting improper verification of resource ownership. This allows altering workflow availability and interfering with task execution in projects they should not access. The issue is fixed in version 3.4.3.

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/{projectCode}/workflow-instances/{id} endpoint. The endpoint does not enforce the write permission required for this operation, allowing the user to make unauthorized changes to workflow instances. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

CVE-2026-71899 is an authorization vulnerability in Apache DolphinScheduler versions 3.2.0 up to but not including 3.4.3. The flaw exists in the `query-dynamic-sub-workflows` API, which fails to properly verify user permissions when accessing workflow data. This allows authenticated users without project access rights to retrieve workflow information from unauthorized projects, leading to information disclosure. The issue is fixed in version 3.4.3.

CVE-2026-78214 is an authentication bypass vulnerability in Apache DolphinScheduler before version 3.4.3. The flaw allows remote unauthenticated attackers to bypass authentication for Actuator endpoints by sending specially crafted requests with percent-encoded paths. This can expose operational or configuration information and potentially sensitive management functionality depending on the configuration. The issue is fixed in version 3.4.3.

An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task. The system does not properly verify whether the user has permission to execute the referenced workflow or access its project. As a result, the user can bypass project-level authorization controls and cause workflows in unauthorized projects to be executed. Successful exploitation may allow unauthorized execution of workflow tasks and access to the resources or data available to the target workflow. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

CVE-2026-82804 is a high-severity OS command injection vulnerability in Apache DolphinScheduler before version 3.4.3. It arises from insufficient neutralization of shell metacharacters in the scriptPath parameter used in a shell command. An authenticated user can exploit this by crafting a resource filename with shell command substitution syntax, leading to arbitrary command execution with DolphinScheduler service privileges. The issue is fixed in version 3.4.3.

Apache DolphinScheduler versions before 3.4.3 contain a vulnerability in the /datasources/unauth-datasource endpoint that fails to properly enforce authorization. Authenticated users can access information about data sources they should not be authorized to view, potentially exposing sensitive configuration and metadata. This issue is fixed in version 3.4.3.

A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Apache DolphinScheduler before version 3.4.2 contains an authorization vulnerability (CWE-863) that allows a general user to mint admin access tokens via the /access-tokens endpoint. This flaw enables privilege escalation to administrative access. The issue is fixed in version 3.4.2.

CVE-2026-47340 is a vulnerability in Apache DolphinScheduler before version 3.4.2 that allows authenticated users to access alert instances linked to alert groups for which they lack permission. This exposure of sensitive information does not affect system integrity or availability but compromises confidentiality. The issue is fixed in version 3.4.2, and users are advised to upgrade to this version to remediate the vulnerability.

Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

An incorrect authorization vulnerability in Apache DolphinScheduler allows users with limited permissions to access workflow instance information from projects they should not have access to. This issue affects versions prior to 3.4.2. The vulnerability has a medium severity rating with a CVSS score of 6.5. Upgrading to version 3.4.2 resolves the issue.

Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue.

An authorization flaw in Apache DolphinScheduler before version 3.4.2 allows unauthorized users to access arbitrary data source metadata via the DataSource API. This vulnerability is identified as CWE-863 Incorrect Authorization. The issue is fixed in version 3.4.2.