Apache DolphinScheduler (Product): news timeline & CVEs

CVE-2026-71896: Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information

DolphinScheduler before 3.4.3 lets authenticated users list other accounts without authorization.

Apache rated CVE-2026-71896 critical in DolphinScheduler before 3.4.3. The /dolphinscheduler/users/list-all endpoint does not enforce required authorization, letting an authenticated user retrieve other users' account information. The advisory does not report exploitation in the wild.

oss-securityOct 8, 02:03 UTC · 23h agoVulnerability 6 sources CVE-2026-71896

CVE-2026-71895: Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials

DolphinScheduler before 3.4.3 lets non-admins retrieve Kubernetes kubeconfig credentials.

CVE-2026-71895 affects Apache DolphinScheduler 3.1.0 before 3.4.3. Authenticated non-admin users can retrieve Kubernetes configuration intended for administrators, including kubeconfig credentials that may allow direct authentication to the Kubernetes API outside DolphinScheduler. Apache rated the issue important, and no in-the-wild exploitation is reported.

oss-securityOct 8, 02:02 UTC · 23h agoVulnerability 6 sources CVE-2026-718951

CVE-2026-71183: Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords

DolphinScheduler before 3.4.3 discloses unauthorized data-source details and passwords.

CVE-2026-71183 is an authorization flaw in Apache DolphinScheduler before 3.4.3. Authenticated users can call /unauth-datasource and /authed-datasource and receive sensitive connection information, including passwords, for data sources they are not permitted to access. Apache rated the issue important; active exploitation is not described.

oss-securityOct 8, 02:00 UTC · 23h agoVulnerability 6 sources CVE-2026-711832

CVE-2026-66087: Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint

DolphinScheduler before 3.4.3 lets authenticated users stop or savepoint tasks in unauthorized projects.

CVE-2026-66087 is a moderate authorization bypass in Apache DolphinScheduler before 3.4.3. Authenticated users can stop or savepoint task instances in projects they are not authorized to access through the task-instance stop and savepoint endpoints. The disclosure does not report in-the-wild exploitation.

oss-securityOct 8, 01:58 UTC · 23h agoVulnerability 6 sources CVE-2026-66087

CVE-2026-66084: Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint

DolphinScheduler before 3.4.3 lets authenticated users change task definitions in projects they do not own.

CVE-2026-66084 is a moderate project authorization bypass in Apache DolphinScheduler before 3.4.3. The task-definition with-upstream endpoint fails to verify that the task definition identified by code belongs to the supplied project, so authenticated users can modify definitions in projects they are not authorized to access. No active exploitation is described.

oss-securityOct 8, 01:56 UTC · 23h agoVulnerability 6 sources CVE-2026-66084

CVE-2026-66082: Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）

DolphinScheduler before 3.4.3 allows cross-project changes to schedules, workflows, and task instances.

CVE-2026-66082 is a moderate authorization bypass in Apache DolphinScheduler before 3.4.3. Authenticated users can operate on workflow schedules, workflow definitions, and task instances in other projects because affected endpoints check the supplied projectCode but do not verify that the target resource belongs to that project. Exploitation in the wild is not reported.

oss-securityOct 8, 01:54 UTC · 23h agoVulnerability 6 sources CVE-2026-660821

CVE-2026-82804: Apache DolphinScheduler: Command Injection in the Alert Script Plugin

Authenticated users can inject shell commands in Apache DolphinScheduler before 3.4.3 through the Alert Script plugin.

Wenjun Ruan disclosed CVE-2026-82804, rated low by Apache, in Apache DolphinScheduler before 3.4.3. The Alert Script plugin incorporates the scriptPath parameter into a /bin/sh -c command without neutralizing shell metacharacters. An authenticated user can create a resource whose filename contains command-substitution syntax such as $(...) and cause the shell to execute it. No in-the-wild exploitation is reported.

oss-securitySep 29, 13:38 UTC · 9d agoVulnerability CVE-2026-82804

CVE-2026-81569: Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution

DolphinScheduler before 3.4.3 lets authenticated users execute workflows in projects they are not allowed to access.

CVE-2026-81569 is a moderate improper-authorization vulnerability in Apache DolphinScheduler API components before 3.4.3. An authenticated user who lacks permission for a target project can reference and invoke a workflow in that project through a sub-workflow task. The application does not properly verify the caller's authorization for the referenced project. No exploitation in the wild is reported.

oss-securitySep 29, 13:36 UTC · 9d agoVulnerability 6 sources CVE-2026-81569

CVE-2026-78214: Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths

Percent-encoded paths can bypass Actuator authentication in Apache DolphinScheduler versions before 3.4.3.

CVE-2026-78214 is an authentication-bypass flaw, rated low by Apache, in Apache DolphinScheduler API versions before 3.4.3. The application decides whether Actuator endpoints require authentication by matching the incoming request path against protected paths. A remote requester can supply a percent-encoded path so the endpoint is not recognized as protected. Active exploitation is not described.

oss-securitySep 29, 13:34 UTC · 9d agoVulnerability 6 sources CVE-2026-78214

CVE-2026-71898: Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

CVE-2026-71898 lets DolphinScheduler read-only users modify workflows through a missing authorization check.

Apache DolphinScheduler versions before 3.4.3 are affected by CVE-2026-71898, an incorrect authorization check rated moderate. An authenticated user with only read permission on a project can modify a workflow instance through PUT /projects/{projectCode}/workflow-instances/{id} because the endpoint does not enforce the required write permission. The disclosure says this can allow the user to execute workflows and tamper with workflow definitions. No exploitation in the wild is reported.

oss-securitySep 29, 13:29 UTC · 9d agoVulnerability 6 sources CVE-2026-718981

CVE-2026-71897: Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints

DolphinScheduler before 3.4.3 lets authenticated users copy or move workflows they are not permitted to access.

Apache DolphinScheduler before 3.4.3 has an improper authorization check on the batch-copy and batch-move endpoints. An authenticated user can copy or move workflows in projects where they lack the required permissions. Apache rates the issue moderate. No exploitation in the wild is reported.

oss-securitySep 29, 13:27 UTC · 9d agoVulnerability 6 sources CVE-2026-71897

CVE-2026-66083: Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource

DolphinScheduler before 3.4.3 can leak unauthorized data-source configuration and metadata to authenticated users.

Apache DolphinScheduler before 3.4.3 fails to enforce authorization on the /datasources/unauth-datasource endpoint. An authenticated user can retrieve information about data sources they are not allowed to access, including configuration and other sensitive metadata depending on returned fields. Apache rates the issue moderate. Exploitation is not mentioned.

oss-securityupdated Sep 29, 13:36 UTC · 9d agofirst Sep 29, 13:25 UTC · 9d agoVulnerability 6 sources CVE-2026-66083

CVE-2026-57590: Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations

Apache DolphinScheduler before 3.4.3 has low-severity missing authorization in Task Group APIs, CVE-2026-57590.

Apache disclosed CVE-2026-57590, a low-severity missing-authorization flaw in DolphinScheduler Task Group APIs before version 3.4.3. The APIs do not properly check whether an authenticated user may access the project associated with a target Task Group, enabling unauthorized cross-project operations. Users are advised to upgrade to 3.4.3, and the report does not describe exploitation in the wild.

oss-securitySep 24, 16:07 UTC · 14d agoVulnerability CVE-2026-57590

Apache DolphinScheduler

Timeline13 articles

Related CVEsby mentions

Appears with