Apache Software Foundation Apache Dolphinscheduler vulnerabilities

CVE-2024-30188 [HIGH] CWE-20 CVE-2024-30188: File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally ac File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2. Users are recommended to upgrade to version 3.2.2, which fixes the issue.

CVE-2022-45462 [CRITICAL] CWE-77 CVE-2022-45462: Alarm instance management has command injection when there is a specific command configured. It is o Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher

CVE-2024-43202 [CRITICAL] CWE-94 CVE-2024-43202: Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinSche Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.2. We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue.

CVE-2023-49109 [CRITICAL] CWE-94 CVE-2023-49109: Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinSche Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.

CVE-2026-82804 [HIGH] CWE-78 CVE-2026-82804: The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitution syntax, such as $(...), and subsequently supplying the

CVE-2022-45875 [CRITICAL] CWE-20 CVE-2022-45875: Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote com Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. This attack can be performed only by authenticated users which can login to DS.

CVE-2026-32966 [CRITICAL] CWE-863 CVE-2026-32966: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apa DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

CVE-2023-49299 [HIGH] CWE-20 CVE-2023-49299: Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue.

CVE-2024-29831 [HIGH] CWE-20 CVE-2024-29831: Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.

CVE-2021-27644 [HIGH] CWE-264 CVE-2021-27644: In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)

CVE-2026-49050 [HIGH] CWE-863 CVE-2026-49050: General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinSch General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

CVE-2026-66084 [HIGH] CWE-863 CVE-2026-66084: An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modif An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream endpoint. The endpoint fails to verify that the task definition identified by code belongs to th

CVE-2024-43166 [CRITICAL] CWE-276 CVE-2024-43166: Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache D Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue.

CVE-2024-43115 [HIGH] CWE-20 CVE-2024-43115: Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execut Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue.

CVE-2026-23902 [HIGH] CWE-863 CVE-2026-23902: Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with sys Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution. This issue affects Apache DolphinScheduler versions prior to 3.4.1. Users are recommended to upgrade to version 3.4.1, which fixes this issue.

CVE-2026-66087 [HIGH] CWE-863 CVE-2026-66087: An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to opera An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the * /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop * /dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint This issu

CVE-2026-57590 [HIGH] CWE-863 CVE-2026-57590: A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.

CVE-2023-51770 [HIGH] CWE-94 CVE-2023-51770: Arbitrary File Read Vulnerability in Apache Dolphinscheduler. This issue affects Apache DolphinSche Arbitrary File Read Vulnerability in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.

CVE-2023-48796 [HIGH] CWE-200 CVE-2023-48796: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheu

CVE-2026-71895 [HIGH] CWE-862 CVE-2026-71895: An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to re An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the Kubernetes API outside DolphinScheduler. The impact de