Threats affecting pkg:maven/org.apache.dolphinscheduler/dolphinscheduler

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a remote unauthenticated attacker can cause the security check to fail to recognize the request as targeting a protected endpoint. As a result, the attacker may bypass authentication and access otherwise restricted Actuator endpoints. Successful exploitation may expose operational or configuration information and, depending on the enabled endpoints and application configuration, allow access to sensitive management functionality. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

A missing authorization vulnerability in Apache DolphinScheduler's query-dynamic-sub-workflows API allows authenticated users without proper project permissions to access workflow information from unauthorized projects. This leads to unauthorized disclosure of workflow data. The vulnerability affects versions from 3.2.0 up to but not including 3.4.3. Upgrading to version 3.4.3 resolves the issue.

CVE-2026-23902 is an incorrect authorization vulnerability in Apache DolphinScheduler prior to version 3.4.1. Authenticated users with system login permissions can execute workflows using tenants not defined on the platform. This could lead to unauthorized access or actions within the system. The vulnerability has a high severity with a CVSS score of 8.1. Users are advised to upgrade to version 3.4.1, which addresses this issue.

CVE-2025-62233 is a deserialization of untrusted data vulnerability in the Apache DolphinScheduler RPC module affecting versions 3.2.0 up to but not including 3.3.1. An attacker with access to Master or Worker nodes can exploit this by sending malicious RPC requests that inject harmful class types, potentially compromising the system. The issue is fixed in version 3.3.1. The vulnerability has a CVSS score of 6.

CVE-2025-62188 is a high-severity vulnerability in Apache DolphinScheduler version 3.1.0 that allows unauthorized actors to access sensitive information, including database credentials. This exposure of sensitive information (CWE-200) can lead to confidentiality breaches. The vulnerability affects management endpoints that are overly exposed by default. Users are advised to upgrade to version 3.2.0 or later to remediate the issue. As a temporary workaround, restricting exposed management endpoints via environment variables or application configuration is recommended. No known exploits are reported in the wild.

Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue.

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue.

CVE-2023-48796 is a vulnerability in Apache DolphinScheduler versions 3.0.0 up to but not including 3.0.2 that allows exposure of sensitive information to unauthorized actors. The exposed information may include sensitive data such as database credentials. The issue is fixed in version 3.0.2. Users unable to upgrade can mitigate the risk by restricting management endpoint exposure via environment variables or configuration changes.