org.apache.dolphinscheduler:dolphinscheduler-alert-server (>=3.0.0 <=3.4.0), org.apache.dolphinscheduler:dolphinscheduler-api (>=3.0.0 <=3.0.6) +11 more potentially affected by CVE-2026-23902 via org.apache.dolphinscheduler:dolphinscheduler-dao (>=3.0.0-alpha <=3.4.0)

org.apache.dolphinscheduler:dolphinscheduler-dao MAVEN version =3.0.0-alpha, =3.0.0, =3.0.0, =3.3.2, =3.0.0, =3.0.0, =3.2.0, =3.1.0, =3.1.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.6 Source cves: CVE-2026-23902 Source advisory: SNYK:JAVA-ORGAPACHEDOLPHINSCHEDULER-16431737...

Incorrect Authorization

Overview org.apache.dolphinscheduler:dolphinscheduler-dao is an A visual DAG workflow scheduling system, dedicated to solving the complex dependencies in data processing. Affected versions of this package are vulnerable to Incorrect Authorization during workflow execution. An attacker can gain...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0 <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-alert (>=1.2.0 <=2.0.0-alpha) +12 more potentially affected by CVE-2023-49620 via org.apache.dolphinscheduler:dolphinscheduler-dao (>=1.2.0 <=3.0.6)

org.apache.dolphinscheduler:dolphinscheduler-dao MAVEN version =1.2.0, =1.1.0, =1.2.0, =2.0.1, =1.2.0, =2.0.0, =3.0.0, =3.0.0, =2.0.2, =1.2.0, =1.3.0, =1.3.6, =1.3.9, =3.0.0, =3.0.0, =3.0.6 Source cves: CVE-2023-49620 Source advisory: OSV:GHSA-R44Q-98GX-PMH2...

Remote Code Execution (RCE)

dolphinscheduler-dao is vulnerable to remote code execution. Using MySQL database with connectorj, an attacker can inject a malicious code in the DolphinScheduler server through jdbc connect parameters input "detectCustomCollations":true,"autoDeserialize":true...