apache__dolphinscheduler_CVE-2023-51770_3-2-00

Apache Dolphinscheduler About Apache DolphinScheduler is a modern data orchestration platform that empowers agile, low-code development of high-performance workflows. It is dedicated to handling complex task dependencies in data pipelines, and provides a wide range of built-in job types out of th...

Apache DolphinScheduler >= 3.1.0, < 3.2.2 Resource File Read And Write

File read and write vulnerability in Apache DolphinScheduler, authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler from 3.1.0 before 3.2.2. id: CVE-2024-30188 info: name: Apache DolphinScheduler = 3.1.0, 3.2.2 Resource File Read And Write...

apache__dolphinscheduler_CVE-2023-49109_3-2-0

Apache Dolphinscheduler 关于 一个分布式易扩展的可视化 DAG 工作流任务调度系统。致力于解决数据处理流程中错综复杂的依赖关系，使调度系统在数据处理流程中开箱即用。 DolphinScheduler 的主要特性如下： 易于部署，提供四种部署方式，包括Standalone、Cluster、Docker和Kubernetes 易于使用，可以通过四种方式创建和管理工作流，包括Web UI、Python SDK和Open API 高可靠高可用，多主多从的去中心化架构，原生支持横向扩展 高性能，性能比其他编排平台快N倍，每天可支持千万级任务 Cloud...

apache__dolphinscheduler_CVE-2023-51770_3_2_1_fixed

Apache Dolphinscheduler 关于 一个分布式易扩展的可视化 DAG 工作流任务调度系统。致力于解决数据处理流程中错综复杂的依赖关系，使调度系统在数据处理流程中开箱即用。 DolphinScheduler 的主要特性如下： 易于部署，提供四种部署方式，包括Standalone、Cluster、Docker和Kubernetes 易于使用，可以通过四种方式创建和管理工作流，包括Web UI、Python SDK、Yaml文件和Open API 高可靠高可用，多主多从的去中心化架构，原生支持横向扩展 高性能，性能比其他编排平台快N倍，每天可支持千万级任务 Cloud...

apache__dolphinscheduler_CVE-2022-26884_2-0-5

Dolphin Scheduler Official Website dolphinscheduler.apache.org...

apache__dolphinscheduler_CVE-2022-34662_2-0-9

Dolphin Scheduler Official Website dolphinscheduler.apache.org...

CVE-2026-49050

General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue...

CVE-2026-49050 Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens

General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue...

EUVD-2026-65391

General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue...

CVE-2026-49050

Apache DolphinScheduler versions prior to 3.4.2 are affected by a privilege escalation vulnerability where a general user can mint admin access tokens by interacting with the /access-tokens endpoint. This grants a low-privileged user full administrative control, resulting in high impact on confid...

PT-2026-81253

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions prior to 3.4.2 Description A general user can mint admin access tokens through the '/access-tokens' endpoint. Recommendations Upgrade to version 3.4.2...

Improper Authorization

Apache DolphinScheduler is vulnerable to Improper Authorization. The vulnerability is due to incorrect authorization checks when accessing workflow instance information, where users can retrieve workflow details from projects they are not authorized to access...

Improper Authorization

Apache DolphinScheduler is vulnerable to Improper Authorization. The vulnerability is due to a missing authorization check in the DataSource API, where requests are not properly validated before returning data source metadata, allowing unauthorized users to disclose sensitive data source...

Improper Authorization

Apache DolphinScheduler is vulnerable to Improper Authorization. The vulnerability is due to incorrect authorization checks in the experimental /v2 interface, where insufficient access control allows attackers to perform unauthorized actions or access protected resources...

EUVD-2026-37584

Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue...

GHSA-694G-J8PJ-CJJ5 Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.

Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue...

EUVD-2026-37582

Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue...

GHSA-WV7F-C794-82V6 Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.

Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue...

EUVD-2026-37581

Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue...

EUVD-2026-37580

DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue...