Apache Software Foundation Dolphinscheduler vulnerabilities

• apache software foundation dolphinscheduler Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information CVE-2026-71896 6.5 MediumOctober 8, 2026
• apache software foundation dolphinscheduler Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials CVE-2026-71895 7.1 HighOctober 8, 2026
• apache software foundation dolphinscheduler Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords CVE-2026-71183 7.1 HighOctober 8, 2026
• apache software foundation dolphinscheduler Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint CVE-2026-66087 8.1 HighOctober 8, 2026
• apache software foundation dolphinscheduler Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint CVE-2026-66084 8.1 HighOctober 8, 2026
• apache software foundation dolphinscheduler Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow） CVE-2026-66082 6.5 MediumOctober 8, 2026
• apache software foundation dolphinscheduler Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints CVE-2026-71897 4.3 MediumSeptember 29, 2026
• apache software foundation dolphinscheduler Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions CVE-2026-71898 4.3 MediumSeptember 29, 2026
• apache software foundation dolphinscheduler Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure CVE-2026-71899 6.5 MediumSeptember 29, 2026
• apache software foundation dolphinscheduler Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths CVE-2026-78214 5.3 MediumSeptember 29, 2026
• apache software foundation dolphinscheduler Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution CVE-2026-81569 4.3 MediumSeptember 29, 2026
• apache software foundation dolphinscheduler Apache DolphinScheduler: Command Injection in the Alert Script Plugin CVE-2026-82804 8.8 HighSeptember 29, 2026
• apache dolphinscheduler Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource CVE-2026-66083 6.5 MediumSeptember 29, 2026
• apache software foundation dolphinscheduler Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations CVE-2026-57590 8.1 HighSeptember 24, 2026
• apache dolphinscheduler Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens CVE-2026-49050 8.8 HighAugust 25, 2026
• apache dolphinscheduler Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access. CVE-2026-47340 Fix available 6.5 MediumJune 17, 2026
• apache dolphinscheduler Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks CVE-2026-32967 Fix available 9.1 CriticalJune 17, 2026
• apache dolphinscheduler Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. CVE-2026-42357 Fix available 6.5 MediumJune 17, 2026
• apache dolphinscheduler Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects CVE-2026-41280 Fix available 4.9 MediumJune 17, 2026
• apache dolphinscheduler Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure CVE-2026-32966 Fix available 9.8 CriticalJune 17, 2026
• apache dolphinscheduler Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution. CVE-2026-23902 Fix available 8.1 HighApril 24, 2026
• apache dolphinscheduler Apache DolphinScheduler: Deserialization of untrusted data in RPC CVE-2025-62233 Fix available 6.3 MediumApril 24, 2026
• apache dolphinscheduler Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint. CVE-2025-62188 Fix available 7.5 HighApril 9, 2026
• apache dolphinscheduler Apache DolphinScheduler Incorrect Default Permissions Vulnerability CVE-2024-43166 Fix available 9.8 CriticalSeptember 3, 2025
• apache dolphinscheduler Apache DolphinScheduler: Alert Script Attack CVE-2024-43115 Fix available 8.8 HighSeptember 3, 2025
• apache dolphinscheduler Apache DolphinScheduler: Remote Code Execution Vulnerability CVE-2024-43202 Public exploitFix available 9.8 CriticalAugust 20, 2024
• apache dolphinscheduler Apache DolphinScheduler: Resource File Read And Write Vulnerability CVE-2024-30188 Fix available 8.1 HighAugust 9, 2024
• apache dolphinscheduler Apache DolphinScheduler: RCE by arbitrary js execution CVE-2024-29831 Fix available 8.8 HighAugust 9, 2024
• apache dolphinscheduler Apache DolphinScheduler: Arbitrary js execution as root for authenticated users CVE-2024-23320 Fix available 8.8 HighFebruary 23, 2024
• apache dolphinscheduler Apache DolphinScheduler: Arbitrary File Read Vulnerability CVE-2023-51770 Public exploitFix available 7.5 HighFebruary 20, 2024
• apache dolphinscheduler Apache DolphinScheduler: Session do not expire after password change CVE-2023-50270 Fix available 6.5 MediumFebruary 20, 2024
• apache dolphinscheduler Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil CVE-2023-49250 Fix available 7.3 HighFebruary 20, 2024
• apache dolphinscheduler Remote Code Execution in Apache Dolphinscheduler CVE-2023-49109 Public exploitFix available 9.8 CriticalFebruary 20, 2024
• apache dolphinscheduler Apache DolphinScheduler: Arbitrary js execute as root for authenticated users CVE-2023-49299 Fix available 8.8 HighDecember 30, 2023
• apache dolphinscheduler Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for CVE-2023-49620 Fix available 6.5 MediumNovember 30, 2023
• apache dolphinscheduler Apache DolphinScheduler: Information Leakage Vulnerability CVE-2023-49068 Fix available 7.5 HighNovember 27, 2023
• apache dolphinscheduler Apache dolphinscheduler sensitive information disclosure CVE-2023-48796 Fix available 7.5 HighNovember 24, 2023
• apache dolphinscheduler Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authentication CVE-2023-25601 Fix available 4.3 MediumApril 20, 2023
• apache dolphinscheduler Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin CVE-2022-45875 Fix available 9.8 CriticalJanuary 4, 2023
• apache dolphinscheduler Apache DolphinScheduler config file read by task risk CVE-2022-26885 Fix available 7.5 HighNovember 24, 2022
• apache dolphinscheduler Apache DolphinScheduler prior to 2.0.5 have command execution vulnerability CVE-2022-45462 Fix available 9.8 CriticalNovember 23, 2022
• apache dolphinscheduler Apache DolphinScheduler prior to 3.0.0 allows path traversal CVE-2022-34662 Public exploitFix available 6.5 MediumNovember 1, 2022
• apache dolphinscheduler Apache DolphinScheduler exposes files without authentication CVE-2022-26884 Public exploitFix available 6.5 MediumOctober 28, 2022
• apache dolphinscheduler Apache DolphinScheduler user registration is vulnerable to ReDoS attacks CVE-2022-25598 Fix available 7.5 HighMarch 30, 2022
• apache dolphinscheduler DolphinScheduler mysql jdbc connector parameters deserialize remote code execution CVE-2021-27644 Fix available 8.8 HighNovember 1, 2021
• apache dolphinscheduler Apache DolphinScheduler (incubating) Permission vulnerability CVE-2020-13922 Fix available 6.5 MediumJanuary 11, 2021