Apache DolphinScheduler CVEs
34 CVEs, 6 protected by Waratek
Overview 34 matches · 6 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
6
17.6%
Rule in development
0
0.0%
Mitigation candidate
1
2.9%
No exploit published
27
79.4%
blocked by ARMR today
6
17.6%
partly blocked
0
0.0%
not blocked
28
82.4%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
1
2.9%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
33
97.1%
split by
peak 8 / quarter
Q4 201
Protected by Waratek1
Critical1
blocked by ARMR today1
No public exploit1
Q1 211
No exploit published1
Medium1
not blocked1
No public exploit1
Q2 210
Q3 210
Q4 211
Protected by Waratek1
High1
blocked by ARMR today1
No public exploit1
Q1 221
No exploit published1
High1
not blocked1
No public exploit1
Q2 220
Q3 220
Q4 224
Protected by Waratek3
No exploit published1
Critical1
High1
Medium2
blocked by ARMR today3
not blocked1
No public exploit4
Q1 231
No exploit published1
Critical1
not blocked1
No public exploit1
Q2 231
No exploit published1
Medium1
not blocked1
No public exploit1
Q3 230
Q4 234
No exploit published4
High3
Medium1
not blocked4
No public exploit4
Q1 245
No exploit published5
Critical1
High3
Medium1
not blocked5
No public exploit5
Q2 240
Q3 243
Mitigation candidate1
No exploit published2
Critical1
High2
not blocked3
Working exploit published1
No public exploit2
Q4 240
Q1 250
Q2 250
Q3 252
No exploit published2
Critical1
High1
not blocked2
No public exploit2
Q4 250
Q1 260
Q2 268
Protected by Waratek1
No exploit published7
Critical2
High2
Medium4
blocked by ARMR today1
not blocked7
No public exploit8
Q3 262
No exploit published2
High1
Medium1
not blocked2
No public exploit2
Q1 21Q3 21Q1 22Q3 22Q1 23Q3 23Q1 24Q3 24Q1 25Q3 25Q1 26Q3 26
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-66083 | Medium | 2026-09-29 | No exploit published | No public exploit | The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata, depending on the fields returned by the endpoint. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue. |
| CVE-2026-49050 | High | 2026-08-25 | No exploit published | No public exploit | General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue. |
| CVE-2026-47340 | Medium | 2026-06-17 | No exploit published | No public exploit | Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue. |
| CVE-2026-42357 | Medium | 2026-06-17 | No exploit published | No public exploit | Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue. |
| CVE-2026-41280 | Medium | 2026-06-17 | No exploit published | No public exploit | Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue. |
| CVE-2026-32967 | Critical | 2026-06-17 | No exploit published | No public exploit | Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue. |
| CVE-2026-32966 | Critical | 2026-06-17 | No exploit published | No public exploit | DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue. |
| CVE-2026-23902 | High | 2026-04-24 | No exploit published | No public exploit | Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution. This issue affects Apache DolphinScheduler versions prior to 3.4.1. Users are recommended to upgrade to version 3.4.1, which fixes this issue. |
| CVE-2025-62233 | Medium | 2026-04-24 | Protected by Waratek | No public exploit | Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module. This issue affects Apache DolphinScheduler: Version >= 3.2.0 and < 3.3.1. Attackers who can access the Master or Worker nodes can compromise the system by creating a StandardRpcRequest, injecting a malicious class type into it, and sending RPC requests to the DolphinScheduler Master/Worker nodes. Users are recommended to upgrade to version [3.3.1], which fixes the issue. |
| CVE-2025-62188 | High | 2026-04-09 | No exploit published | No public exploit | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler. This vulnerability may allow unauthorized actors to access sensitive information, including database credentials. This issue affects Apache DolphinScheduler versions 3.1.*. Users are recommended to upgrade to: * version ≥ 3.2.0 if using 3.1.x As a temporary workaround, users who cannot upgrade immediately may restrict the exposed management endpoints by setting the following environment variable: ``` MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus ``` Alternatively, add the following configuration to the application.yaml file: ``` management: endpoints: web: exposure: include: health,metrics,prometheus ``` This issue has been reported as CVE-2023-48796: https://cveprocess.apache.org/cve5/CVE-2023-48796 |
| CVE-2024-43166 | Critical | 2025-09-03 | No exploit published | No public exploit | Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue. |
| CVE-2024-43115 | High | 2025-09-03 | No exploit published | No public exploit | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue. |
| CVE-2024-43202 | Critical | 2024-08-20 | No exploit published | No public exploit | Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.2. We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue. |
| CVE-2024-30188 | High | 2024-08-12 | Mitigation candidate | Working exploit published | File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2. Users are recommended to upgrade to version 3.2.2, which fixes the issue. |
| CVE-2024-29831 | High | 2024-08-12 | No exploit published | No public exploit | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2. |
| CVE-2024-23320 | High | 2024-02-23 | No exploit published | No public exploit | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This issue affects Apache DolphinScheduler: until 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. |
| CVE-2023-51770 | High | 2024-02-20 | No exploit published | No public exploit | Arbitrary File Read Vulnerability in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue. |
| CVE-2023-50270 | Medium | 2024-02-20 | No exploit published | No public exploit | Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to version 3.2.1, which fixes this issue. |
| CVE-2023-49250 | High | 2024-02-20 | No exploit published | No public exploit | Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which fixes the issue. |
| CVE-2023-49109 | Critical | 2024-02-20 | No exploit published | No public exploit | Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue. |
| CVE-2023-49299 | High | 2023-12-30 | No exploit published | No public exploit | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue. |
| CVE-2023-49620 | Medium | 2023-11-30 | No exploit published | No public exploit | Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve as moderate level because it still requires user login to operate, please upgrade to version 3.1.0 to avoid this vulnerability |
| CVE-2023-49068 | High | 2023-11-27 | No exploit published | No public exploit | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the mean time, we recommend you make sure the logs are only available to trusted operators. |
| CVE-2023-48796 | High | 2023-11-24 | No exploit published | No public exploit | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file ``` management: endpoints: web: exposure: include: health,metrics,prometheus ``` This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue. |
| CVE-2023-25601 | Medium | 2023-04-20 | No exploit published | No public exploit | On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version 3.0.0 to 3.1.1, you can turn off the python-gateway function by changing the value `python-gateway.enabled=false` in configuration file `application.yaml`. If you are using the python gateway, please upgrade to version 3.1.2 or above. |
| CVE-2022-45875 | Critical | 2023-01-04 | No exploit published | No public exploit | Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. This attack can be performed only by authenticated users which can login to DS. |
| CVE-2022-26885 | High | 2022-11-24 | No exploit published | No public exploit | When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher. |
| CVE-2022-45462 | Critical | 2022-11-23 | Protected by Waratek | No public exploit | Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher |
| CVE-2022-34662 | Medium | 2022-11-01 | Protected by Waratek | No public exploit | When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. You could upgrade to version 3.0.0 or higher |
| CVE-2022-26884 | Medium | 2022-10-28 | Protected by Waratek | No public exploit | Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher. |
| CVE-2022-25598 | High | 2022-03-30 | No exploit published | No public exploit | Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher. |
| CVE-2021-27644 | High | 2021-11-01 | Protected by Waratek | No public exploit | In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password) |
| CVE-2020-13922 | Medium | 2021-01-11 | No exploit published | No public exploit | Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface. |
| CVE-2020-11974 | Critical | 2020-12-18 | Protected by Waratek | No public exploit | In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database. |