apache__dolphinscheduler_CVE-2023-51770_3_2_1_fixed

Apache Dolphinscheduler 소개 Apache DolphinScheduler는 현대적인 데이터 오케스트레이션 플랫폼입니다. 로우코드로 고성능 워크플로우를 민첩하게 생성할 수 있습니다. 또한 강력한 사용자 인터페이스를 제공하며, 데이터 파이프라인의 복잡한 작업 종속성을 해결하고 다양한 유형의 작업을 즉시 사용 가능 하게 제공하는 데 전념하고 있습니다. DolphinScheduler의 주요 기능은 다음과 같습니다: 쉬운 배포: Standalone, Cluster, Docker 및 Kubernetes를 포함한 네 가지...

apache__dolphinscheduler_CVE-2023-49109_3-2-0

Apache Dolphinscheduler 소개 Apache DolphinScheduler는 민첩하고 로우 코드 방식의 고성능 워크플로우 개발을 지원하는 현대적인 데이터 오케스트레이션 플랫폼입니다. 데이터 파이프라인의 복잡한 작업 종속성을 처리하는 데 중점을 두며, 즉시 사용 가능한 다양한 내장 작업 유형을 제공합니다. DolphinScheduler의 주요 기능은 다음과 같습니다: 쉬운 배포: Standalone, Cluster, Docker, Kubernetes를 포함한 네 가지 배포 모드를 제공합니다. 사용하기 쉬움: We...

apache__dolphinscheduler_CVE-2022-26884_2-0-5

Dolphin Scheduler 공식 웹사이트 dolphinscheduler.apache.org Total Lines 디자인 특징 DolphinScheduler는 강력한 DAG 시각화 인터페이스를 갖춘 분산 및 확장 가능한 워크플로 스케줄러 플랫폼으로, 데이터 파이프라인에서 복잡한 작업 종속성을 해결하고 다양한 유형의 작업을 out of the box로 제공하는 데 전념합니다. 주요 목표는 다음과 같습니다: DAG 그래프에서 작업 간의 종속성에 따라 작업을 연결하여 작업의 실행 상태를 실시간으로 시각화할 수 있습니다. Shel...

apache__dolphinscheduler_CVE-2023-51770_3-2-00

Apache Dolphinscheduler 소개 Apache DolphinScheduler는 민첩하고 로우코드 방식의 고성능 워크플로우 개발을 가능하게 하는 현대적인 데이터 오케스트레이션 플랫폼입니다. 데이터 파이프라인의 복잡한 작업 종속성을 처리하는 데 전념하며, 즉시 사용 가능한 다양한 내장 작업 유형을 제공합니다. DolphinScheduler의 주요 기능은 다음과 같습니다: 배포가 용이하며, Standalone, Cluster, Docker 및 Kubernetes를 포함한 네 가지 배포 모드를 제공합니다. 사용하기 쉬우...

CVE-2026-71899

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...

CVE-2026-78214

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...

CVE-2026-81569

An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task. The system does not properly verify whethe...

CVE-2026-71898

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71897

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. Th...

CVE-2026-82804

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

EUVD-2026-88819

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. Th...

CVE-2026-71897 Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. Th...

CVE-2026-71897

Apache DolphinScheduler versions prior to 3.4.3 are vulnerable to an improper authorization check within the batch-copy and batch-move endpoints. An authenticated user can exploit this flaw to operate on workflows in projects for which they lack the necessary permissions, potentially allowing the...

CVE-2026-71897 Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. Th...

CVE-2026-71898 Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

EUVD-2026-88817

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898 Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898

Apache DolphinScheduler versions before 3.4.3 are vulnerable to an incorrect authorization check that allows an authenticated user with only read permission for a project to modify a workflow instance. By accessing the PUT /projects/{projectCode}/workflow-instances/{id} endpoint, which fails to e...

CVE-2026-71899 Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...

EUVD-2026-88816

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...