CVE-2026-71183: Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords
DolphinScheduler before 3.4.3 discloses unauthorized data-source details and passwords.
Stories per day · 30 days
2 RSS
4 stories, newest first · one card per story
Stories tagged #dolphinscheduler
CVE-2026-82804: Apache DolphinScheduler: Command Injection in the Alert Script Plugin
Authenticated users can inject shell commands in Apache DolphinScheduler before 3.4.3 through the Alert Script plugin.
CVE-2026-71898: Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions
CVE-2026-71898 lets DolphinScheduler read-only users modify workflows through a missing authorization check.
CVE-2026-57590: Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations
Apache DolphinScheduler before 3.4.3 has low-severity missing authorization in Task Group APIs, CVE-2026-57590.