Apache Software Foundation Apache Dolphinscheduler vulnerabilities

CVE-2025-62233 [MEDIUM] CWE-502 CVE-2025-62233: Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module. This issue a Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module. This issue affects Apache DolphinScheduler: Version >= 3.2.0 and < 3.3.1. Attackers who can access the Master or Worker nodes can compromise the system by creating a StandardRpcRequest, injecting a malicious class type into it, and sending RPC requests to the Do

CVE-2023-49250 [HIGH] CWE-295 CVE-2023-49250: Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which fixes the issue.

CVE-2026-71183 [HIGH] CWE-863 CVE-2026-71183: An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain infor An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls and return sensitive connection information, includin

CVE-2022-26885 [HIGH] CWE-200 CVE-2022-26885: When using tasks to read config files, there is a risk of database password disclosure. We recommend When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher.

CVE-2026-66083 [MEDIUM] CWE-306 CVE-2026-66083: The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata, depending on the fields returned by the endpoint. This iss

CVE-2026-66082 [MEDIUM] CWE-863 CVE-2026-66082: An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perfo An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects. The affected endpoints check permissions against the supplied projectCode but fail to verify that the target resource belongs to that proje

CVE-2026-71896 [MEDIUM] CWE-863 CVE-2026-71896: An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve oth An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before returning user account information. As a result, an authent

CVE-2026-71899 [MEDIUM] CWE-863 CVE-2026-71899: A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache Dolp A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a specific project can invoke the API with parameters re

CVE-2023-49068 [HIGH] CWE-200 CVE-2023-49068: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you m

CVE-2020-13922 [MEDIUM] CWE-264 CVE-2020-13922: Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to over Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.

CVE-2022-25598 [HIGH] CWE-1333 CVE-2022-25598: Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.

CVE-2026-78214 [MEDIUM] CWE-863 CVE-2026-78214: An authentication bypass vulnerability exists in the protection of Actuator endpoints. The applicati An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a remote unauthenticated attacker can cause the security

CVE-2022-26884 [MEDIUM] CWE-22 CVE-2022-26884: Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0. Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.

CVE-2023-49620 [MEDIUM] CWE-862 CVE-2023-49620: Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource cent Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version

CVE-2022-34662 [MEDIUM] CWE-22 CVE-2022-34662: When users add resources to the resource center with a relation path will cause path traversal issue When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. You could upgrade to version 3.0.0 or higher

CVE-2023-50270 [MEDIUM] CWE-613 CVE-2023-50270: Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after th Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue.

CVE-2026-71898 [MEDIUM] CWE-863 CVE-2026-71898: An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only r An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/{projectCode}/workflow-instances/{id} endpoint. The endpoint does not enforce the write permission required for this operation, allowing the user to m

CVE-2026-81569 [MEDIUM] CWE-285 CVE-2026-81569: An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticat An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task. The system does not properly verify whether the user has permission to execute the referenced

CVE-2023-25601 [MEDIUM] CWE-287 CVE-2023-25601: On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper auth On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version 3.0.0 to 3.1.1, you can turn off the python-gateway function by changing the value `python-

CVE-2026-71897 [MEDIUM] CWE-863 CVE-2026-71897: An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the b An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. This issue affects Apache DolphinScheduler: before 3.4