Apache DolphinScheduler >= 3.1.0, < 3.2.2 Resource File Read And Write

File read and write vulnerability in Apache DolphinScheduler, authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler from 3.1.0 before 3.2.2. id: CVE-2024-30188 info: name: Apache DolphinScheduler = 3.1.0, 3.2.2 Resource File Read And Write...

apache__dolphinscheduler_CVE-2023-51770_3_2_1_fixed

Apache Dolphinscheduler 关于 一个分布式易扩展的可视化 DAG 工作流任务调度系统。致力于解决数据处理流程中错综复杂的依赖关系，使调度系统在数据处理流程中开箱即用。 DolphinScheduler 的主要特性如下： 易于部署，提供四种部署方式，包括Standalone、Cluster、Docker和Kubernetes 易于使用，可以通过四种方式创建和管理工作流，包括Web UI、Python SDK、Yaml文件和Open API 高可靠高可用，多主多从的去中心化架构，原生支持横向扩展 高性能，性能比其他编排平台快N倍，每天可支持千万级任务 Cloud...

apache__dolphinscheduler_CVE-2023-51770_3-2-00

Apache Dolphinscheduler 概要 Apache DolphinSchedulerは、アジャイルでローコードな高性能ワークフロー開発を実現する最新のデータオーケストレーションプラットフォームです。データパイプラインにおける複雑なタスク依存関係の処理に特化しており、豊富な組み込みジョブタイプをすぐに利用可能 な状態で提供します。 DolphinSchedulerの主な特徴は次のとおりです。 デプロイが容易: Standalone、Cluster、Docker、Kubernetesの4つのデプロイモードを提供します。 使いやすい: Web UI、Python...

apache__dolphinscheduler_CVE-2022-34662_2-0-9

Dolphin Scheduler Official Website dolphinscheduler.apache.org Total Lines 设计特点 一个分布式易扩展的可视化DAG工作流任务调度系统。致力于解决数据处理流程中错综复杂的依赖关系，使调度系统在数据处理流程中开箱即用。 其主要目标如下： 以DAG图的方式将Task按照任务的依赖关系关联起来，可实时可视化监控任务的运行状态 支持丰富的任务类型：Shell、MR、Spark、SQLmysql、postgresql、hive、sparksql,Python,SubProcess、Procedure等...

apache__dolphinscheduler_CVE-2023-49109_3-2-0

Apache Dolphinscheduler 概要 Apache DolphinSchedulerは、アジャイルでローコードな高性能ワークフローの開発を可能にする最新のデータオーケストレーションプラットフォームです。データパイプライン内の複雑なタスク依存関係の処理に特化しており、すぐに使用できる 多彩な組み込みジョブタイプを提供します。 DolphinSchedulerの主な特徴は以下の通りです。 デプロイが容易で、Standalone、Cluster、Docker、Kubernetesを含む4つのデプロイモードを提供します。 使いやすく、ワークフローはWeb UI、Python...

apache__dolphinscheduler_CVE-2022-26884_2-0-5

Dolphin Scheduler Official Website dolphinscheduler.apache.org Total Lines 设计特点 一个分布式易扩展的可视化DAG工作流任务调度系统。致力于解决数据处理流程中错综复杂的依赖关系，使调度系统在数据处理流程中开箱即用。 其主要目标如下： 以DAG图的方式将Task按照任务的依赖关系关联起来，可实时可视化监控任务的运行状态 支持丰富的任务类型：Shell、MR、Spark、SQLmysql、postgresql、hive、sparksql,Python,SubProcess、Procedure等...

CVE-2026-78214

An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a...

CVE-2026-71899

A missing authorization vulnerability exists in the query-dynamic-sub-workflows API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried. An authenticated user who does not have permission to access a...

CVE-2026-81569

An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task. The system does not properly verify whethe...

CVE-2026-71898

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71897

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. Th...

CVE-2026-82804

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

EUVD-2026-88819

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. Th...

CVE-2026-71897 Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. Th...

CVE-2026-71897

Apache DolphinScheduler versions prior to 3.4.3 are vulnerable to an improper authorization check within the batch-copy and batch-move endpoints. An authenticated user can exploit this flaw to operate on workflows in projects for which they lack the necessary permissions, potentially allowing the...

CVE-2026-71897 Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints

An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects. Th...

EUVD-2026-88817

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898 Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898 Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions

An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/projectCode/workflow-instances/id endpoint. The endpoint does not enforce the write permission...

CVE-2026-71898

Apache DolphinScheduler versions before 3.4.3 are vulnerable to an incorrect authorization check that allows an authenticated user with only read permission for a project to modify a workflow instance. By accessing the PUT /projects/{projectCode}/workflow-instances/{id} endpoint, which fails to e...