org.apache.dolphinscheduler:dolphinscheduler vulnerabilities (Maven)

17 vulnerabilities.

• org.apache.dolphinscheduler:dolphinscheduler Maven Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution. CVE-2026-23902 Fix available 8.1 HighApril 24, 2026
• org.apache.dolphinscheduler:dolphinscheduler Maven Apache DolphinScheduler: Deserialization of untrusted data in RPC CVE-2025-62233 Fix available 6.3 MediumApril 24, 2026
• org.apache.dolphinscheduler:dolphinscheduler Maven Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint. CVE-2025-62188 Fix available 7.5 HighApril 9, 2026
• org.apache.dolphinscheduler:dolphinscheduler Maven Apache DolphinScheduler Incorrect Default Permissions Vulnerability CVE-2024-43166 Fix available 9.8 CriticalSeptember 3, 2025
• org.apache.dolphinscheduler:dolphinscheduler Maven Apache DolphinScheduler: Alert Script Attack CVE-2024-43115 Fix available 8.8 HighSeptember 3, 2025
• org.apache.dolphinscheduler:dolphinscheduler Maven Apache DolphinScheduler: Resource File Read And Write Vulnerability CVE-2024-30188 Fix available 8.1 HighAugust 9, 2024
• org.apache.dolphinscheduler:dolphinscheduler Maven Apache DolphinScheduler: RCE by arbitrary js execution CVE-2024-29831 Fix available 8.8 HighAugust 9, 2024
• org.apache.dolphinscheduler:dolphinscheduler Maven Apache DolphinScheduler: Arbitrary File Read Vulnerability CVE-2023-51770 Public exploitFix available 7.5 HighFebruary 20, 2024
• org.apache.dolphinscheduler:dolphinscheduler Maven Apache DolphinScheduler: Session do not expire after password change CVE-2023-50270 Fix available 6.5 MediumFebruary 20, 2024
• org.apache.dolphinscheduler:dolphinscheduler Maven Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil CVE-2023-49250 Fix available 7.3 HighFebruary 20, 2024
• org.apache.dolphinscheduler:dolphinscheduler Maven Remote Code Execution in Apache Dolphinscheduler CVE-2023-49109 Public exploitFix available 9.8 CriticalFebruary 20, 2024
• org.apache.dolphinscheduler:dolphinscheduler Maven Apache dolphinscheduler sensitive information disclosure CVE-2023-48796 Fix available 7.5 HighNovember 24, 2023
• org.apache.dolphinscheduler:dolphinscheduler Maven Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin CVE-2022-45875 Fix available 9.8 CriticalJanuary 4, 2023
• org.apache.dolphinscheduler:dolphinscheduler Maven Apache DolphinScheduler prior to 3.0.0 allows path traversal CVE-2022-34662 Public exploitFix available 6.5 MediumNovember 1, 2022
• org.apache.dolphinscheduler:dolphinscheduler Maven Apache DolphinScheduler exposes files without authentication CVE-2022-26884 Public exploitFix available 6.5 MediumOctober 28, 2022
• org.apache.dolphinscheduler:dolphinscheduler Maven Apache DolphinScheduler user registration is vulnerable to ReDoS attacks CVE-2022-25598 Fix available 7.5 HighMarch 30, 2022
• org.apache.dolphinscheduler:dolphinscheduler Maven Remote code execution in DolphinScheduler CVE-2020-11974 Fix available 9.8 CriticalDecember 18, 2020