Apache Dolphinscheduler vulnerabilities

CVE-2022-26885 [HIGH] CWE-200 CVE-2022-26885: When using tasks to read config files, there is a risk of database password disclosure. We recommend When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher.

CVE-2026-66083 [MEDIUM] CWE-306 CVE-2026-66083: The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata, depending on the fields returned by the endpoint. This iss

CVE-2023-49068 [HIGH] CWE-200 CVE-2023-49068: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you m

CVE-2020-13922 [MEDIUM] CWE-264 CVE-2020-13922: Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to over Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.

CVE-2022-25598 [HIGH] CWE-1333 CVE-2022-25598: Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.

CVE-2022-26884 [MEDIUM] CWE-22 CVE-2022-26884: Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0. Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.

CVE-2023-49620 [MEDIUM] CWE-862 CVE-2023-49620: Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource cent Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version

CVE-2022-34662 [MEDIUM] CWE-22 CVE-2022-34662: When users add resources to the resource center with a relation path will cause path traversal issue When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. You could upgrade to version 3.0.0 or higher

CVE-2023-50270 [MEDIUM] CWE-613 CVE-2023-50270: Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after th Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.

CVE-2023-25601 [MEDIUM] CWE-287 CVE-2023-25601: On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper auth On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version 3.0.0 to 3.1.1, you can turn off the python-gateway function by changing the value `python-