apache__dolphinscheduler_CVE-2023-51770_3-2-00

Apache Dolphinscheduler About Apache DolphinScheduler is a modern data orchestration platform that empowers agile, low-code development of high-performance workflows. It is dedicated to handling complex task dependencies in data pipelines, and provides a wide range of built-in job types out of th...

apache__dolphinscheduler_CVE-2023-49109_3-2-0

Apache Dolphinscheduler About Apache DolphinScheduler is a modern data orchestration platform that empowers agile, low-code development of high-performance workflows. It is dedicated to handling complex task dependencies in data pipelines, and provides a wide range of built-in job types out of th...

apache__dolphinscheduler_CVE-2022-26884_2-0-5

Dolphin Scheduler Official Website dolphinscheduler.apache.org Total Lines Design Features DolphinScheduler is a distributed and extensible workflow scheduler platform with powerful DAG visual interfaces, dedicated to solving complex job dependencies in the data pipeline and providing various typ...

apache__dolphinscheduler_CVE-2023-51770_3_2_1_fixed

Apache Dolphinscheduler About Apache DolphinScheduler is the modern data orchestration platform. Agile to create high performance workflow with low-code. It is also provided powerful user interface, dedicated to solving complex task dependencies in the data pipeline and providing various types of...

CVE-2026-71183

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...

CVE-2026-71896

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before returni...

CVE-2026-71895

An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the...

CVE-2026-66084

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-definition/code/with-upstream endpoint. The endpoint fails to verify that th...

CVE-2026-66087

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to access through the /dolphinscheduler/projects/projectCode/task-instances/taskInstanceId/stop...

CVE-2026-66082

An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow schedules, workflow definitions, and task instances in other projects. The affected endpoints check permissions against the supplied projectCode but fail to...

CVE-2026-71896

An authorization vulnerability exists in Apache DolphinScheduler affecting versions before 3.4.3 . The /dolphinscheduler/users/list-all endpoint fails to properly enforce authorization checks, allowing authenticated users to retrieve account information of other users without required permissions...

EUVD-2026-94810

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before returni...

CVE-2026-71896 Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through the /dolphinscheduler/users/list-all endpoint without the required permissions. The endpoint fails to enforce the necessary authorization checks before returni...

CVE-2026-71895 Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials

An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the...

EUVD-2026-94809

An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the...

CVE-2026-71895

An authorization vulnerability in Apache DolphinScheduler (versions 3.2.0 before 3.4.3 ) allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrators. The exposed kubeconfig data contains credentials that could permit unauthorized access to the Kubern...

CVE-2026-71183

An authorization vulnerability in Apache DolphinScheduler (versions before 3.4.3 ) allows authenticated users to access data sources they are not authorized to view. The /unauth-datasource and /authed-datasource endpoints fail to enforce proper access controls, potentially leaking sensitive conne...

EUVD-2026-94808

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.0, <=3.4.2) potentially affected by CVE-2026-71183 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.0, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.0, =3.4.0, =3.4.2 Source cves: CVE-2026-71183 Source advisory: MEND:CVE-2026-71183...

CVE-2026-71183 Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...