Priority LOW 29
The /datasources/unauth-datasource endpoint does not properly enforce data source authorization.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00305 · Published 2026-09-29 · Fixed in 3.4.3 CWE-306
Priority MEDIUM 41
General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00576 · Published 2026-08-25 · Fixed in 3.4.2 CWE-863
Priority LOW 29
Allow authenticated users to access alert instances associated with alert groups they do not have permission to access.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00434 · Published 2026-06-17 · Fixed in 3.4.2 CWE-200
Priority MEDIUM 45
Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00337 · Published 2026-06-17 · Fixed in 3.4.2 CWE-863
Priority LOW 29
Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00312 · Published 2026-06-17 · Fixed in 3.4.1, 3.4.2 CWE-863
Priority LOW 23
Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00437 · Published 2026-06-17 · Fixed in 3.4.2 CWE-863
Priority MEDIUM 48
DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0039 · Published 2026-06-17 · Fixed in 3.4.2 CWE-863
Priority LOW 38
Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00446 · Published 2026-04-24 · Fixed in 3.4.1 CWE-863
Priority LOW 29
Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module.
CVSS 3.1MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.00537 · Published 2026-04-24 · Fixed in 3.3.1 CWE-502
Priority MEDIUM 40
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00541 · Published 2026-04-09 · Fixed in 3.2.0 CWE-200
Priority MEDIUM 50
Incorrect Default Permissions vulnerability in Apache DolphinScheduler.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00533 · Published 2025-09-03 · Fixed in 3.2.2, 3.3.1 CWE-276
Priority MEDIUM 41
Improper Input Validation vulnerability in Apache DolphinScheduler.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00592 · Published 2025-09-03 · Fixed in 3.2.2 CWE-20
Priority MEDIUM 53
Exposure of Remote Code Execution in Apache Dolphinscheduler.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02149 · Published 2024-08-20 · Fixed in 3.2.2 CWE-94
Priority MEDIUM 49
File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.05987 · Published 2024-08-09 · Fixed in 3.2.2 CWE-20
Priority MEDIUM 42
Improper Input Validation vulnerability in Apache DolphinScheduler.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01175 · Published 2024-08-09 · Fixed in 3.2.2 CWE-20
Priority MEDIUM 43
Improper Input Validation vulnerability in Apache DolphinScheduler.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01388 · Published 2024-02-23 · Fixed in 3.2.1 CWE-20
Priority LOW 35
Arbitrary File Read Vulnerability in Apache Dolphinscheduler.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01239 · Published 2024-02-20 · Fixed in 3.2.1 CWE-94
Priority LOW 37
Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01306 · Published 2024-02-20 · Fixed in 3.2.1 CWE-613
Priority LOW 33
Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00704 · Published 2024-02-20 · Fixed in 3.2.1 CWE-295
Priority MEDIUM 53
Exposure of Remote Code Execution in Apache Dolphinscheduler.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02301 · Published 2024-02-20 · Fixed in 3.2.1 CWE-94
Priority MEDIUM 43
Improper Input Validation vulnerability in Apache DolphinScheduler.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0143 · Published 2023-12-30 · Fixed in 3.1.9 CWE-20
Priority LOW 31
Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0…
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01132 · Published 2023-11-30 · Fixed in 3.1.0 CWE-862
Priority LOW 35
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01052 · Published 2023-11-27 · Fixed in 3.2.1 CWE-200
Priority LOW 35
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01191 · Published 2023-11-24 · Fixed in 3.0.2 CWE-200
Priority LOW 22
On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.01127 · Published 2023-04-20 · Fixed in 3.1.2 CWE-287
Load more
THREATIST.IORead the docs