CVE-2023-51770

CVE-2023-51770 affects Apache DolphinScheduler and is described as an Arbitrary File Read Vulnerability exploitable before version 3.2.1. The vulnerability affects DolphinScheduler components (disclosed across multiple feeds) and is mitigated by upgrading to version 3.2.1. Exploitation details or...

CVE-2023-49250

Apache DolphinScheduler versions before 3.2.1 are vulnerable to a Man-in-the-Middle (MITM) attack due to improper certificate validation. Specifically, the HttpUtils class fails to verify certificates during outgoing HTTPS connections, allowing an attacker to intercept traffic and impersonate the...

CVE-2023-50270

Apache DolphinScheduler versions before 3.2.0 are vulnerable to Session Fixation due to improper session management within LoginController.java. Specifically, the system fails to deactivate existing sessions when a user changes their password. An attacker could exploit this by sending a specially...

CVE-2023-49109

Apache DolphinScheduler versions prior to 3.2.1 are vulnerable to Remote Code Execution (RCE) . The root cause is the improper validation of user input within the HttpTaskDefinitionParser.java file of the org.apache.dolphinscheduler:dolphinscheduler-task-api component. This flaw allows an attacke...

CVE-2024-23320

Apache DolphinScheduler is vulnerable to an Improper Input Validation vulnerability in versions prior to 3.2.1 . An authenticated user can execute arbitrary, unsandboxed JavaScript on the server by submitting crafted input. Specifically, the vulnerability stems from missing validation in the gene...

CVE-2022-25598

CVE-2022-25598 affects Apache DolphinScheduler. The vulnerability is a Regular Expression Denial of Service (ReDoS) in the user registration interface, exploited by crafted input to cause denial of service. Impact is partial availability degradation of the application. The public guidance in the ...

CVE-2024-30188

CVE-2024-30188 – Apache DolphinScheduler : Affected versions are 3.1.0 up to, but not including, 3.2.2. The issue is a resource file read/write vulnerability that allows authenticated users to access (and potentially modify) additional resource files. The core impact is unauthorized access to res...

CVE-2020-11974

Technical details for CVE-2020-11974 are not publicly available in the provided documents. No affected products/versions/fixes are specified beyond the initial description. Monitor for updates.

CVE-2022-26884

CVE-2022-26884 affects Apache DolphinScheduler prior to version 2.0.6, introducing a path traversal vulnerability where a log server request could allow reading arbitrary files. The root cause is inadequate filtering of resources/files in path handling. Impact is limited to confidentiality (high)...

CVE-2022-26885

Apache Dolphin Scheduler is affected by CVE-2022-26885, where using tasks to read config files can disclose database passwords. The issue stems from improper handling of logs in LoggerRequestProcessor.java, per Veracode and related advisories. Affected product: Dolphin Scheduler server; vulnerabi...

CVE-2023-49299

CVE-2023-49299 (Apache DolphinScheduler) : An authenticated user can trigger server-side, unsandboxed JavaScript execution due to improper input validation. The issue affects DolphinScheduler prior to fixed versions and is treated as a legacy/continued vulnerability in later advisories. A fix is ...

CVE-2023-48796

CVE-2023-48796 affects Apache DolphinScheduler (3.0.0–3.0.1). Root cause: exposure of sensitive information to unauthorized actors via the management endpoints web exposure, enabling leakage such as database credentials. Impact per sources: unauthorized access to sensitive data; high CVSS appears...

CVE-2022-45875

Apache DolphinScheduler (CVE-2022-45875) is affected by improper validation of script alert plugin parameters, allowing remote command execution. The issue affects 3.0.1 and earlier, and 3.1.0 and earlier; authenticated users who can log in to DolphinScheduler could exploit it. CVSSv3.1 base scor...

CVE-2022-34662

CVE-2022-34662 affects Apache DolphinScheduler. The resource-center path traversal vulnerability occurs when users add resources with a relation path and is applicable to versions prior to 3.0.0. The vulnerability is described as present for logged-in users, with the recommended remediation to up...

CVE-2024-29831

CVE-2024-29831 relates to an improper input validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed JavaScript to be executed on the server, potentially enabling remote code execution. Affected: DolphinScheduler; remediation guidance consistentl...

CVE-2020-13922

CVE-2020-13922 affects Apache DolphinScheduler prior to 1.3.2. An ordinary user under any tenant can override another user’s password via the API interface. Connected documents corroborate the same description across multiple sources (Red Hat, OSV, GHSA, CVE records). The exact remediation steps ...

CVE-2021-27644

CVE-2021-27644 affects Apache DolphinScheduler prior to 1.3.6. Authorized users can trigger SQL injection in the data source center when using a MySQL data source with internal login credentials, potentially exposing or altering data in the underlying database. The related records consistently de...

CVE-2022-45462

Summary: Apache DolphinScheduler contains a command injection vulnerability in the Alarm/Alert Instance Management service when a specific command is configured. The issue affects versions prior to 2.0.6 and could allow an attacker to inject commands. The vulnerability is rated critical (CVSS v3....

CVE-2024-43202

CVE-2024-43202 is an exposure of Remote/Code Injection in Apache DolphinScheduler prior to 3.2.2. A related exploit repo (GitHub) references a code-injection vulnerability affecting DolphinScheduler, and multiple advisories describe the issue as a remote code execution risk. The core remediation ...

CVE-2023-49068

CVE-2023-49068 affects Apache DolphinScheduler (before 3.2.1). The issue is exposure of sensitive information to an unauthorized actor via logs, with risk of leaking session-related data. Root cause is that log statements in the DolphinScheduler codebase may retain sensitive fields (e.g., session...

CVE-2025-62233

Apache DolphinScheduler is vulnerable to a deserialization of untrusted data flaw in its RPC module affecting versions >= 3.2.0 and

CVE-2023-25601

CVE-2023-25601 describes an improper authentication flaw in Apache DolphinScheduler’s python gateway affecting versions 3.0.0–3.1.1. The issue could permit a socket-based attack without authentication. The vulnerability is fixed in version 3.1.2 and later. Remediation options from the documented ...

CVE-2026-32967

The CVE-2026-32967 issue is an Incorrect Authorization vulnerability in Apache DolphinScheduler's /v2 experimental interface. Affected software: DolphinScheduler before version 3.4.2. Root cause: missing/incorrect permission checks on the /v2 endpoint. Impact: authorization bypass risk for the in...

CVE-2023-49620

CVE-2023-49620 affects Apache DolphinScheduler prior to 3.1.0. An authenticated user could delete UDF functions in the resource center (an operation commonly used by SQL tasks) due to an unauthorized access (IDOR) vulnerability. Red Hat, Veracode, GHSA and CVE records corroborate the issue, with ...

CVE-2024-43166

Apache DolphinScheduler versions prior to 3.2.2 are vulnerable to an Incorrect Default Permissions (CWE-276) vulnerability. The root cause stems from improper default access settings within the application, which could allow an attacker to gain unauthorized access to resources or perform unintend...

CVE-2026-32966

The CVE affects Apache DolphinScheduler prior to 3.4.2. A missing authorization check in the DataSource API allows exposure of arbitrary data source metadata to unauthenticated users, enabling potential disclosure of sensitive information. The issue’s root cause is insufficient access control on ...

CVE-2026-41280

Apache DolphinScheduler versions prior to 3.4.2 are vulnerable to an Incorrect Authorization issue in the delete task definitions module. The vulnerability stems from insufficient authorization checks, allowing users with valid system login privileges to delete task definitions in projects they a...

CVE-2026-23902

Apache DolphinScheduler versions prior to 3.4.1 are susceptible to an Incorrect Authorization vulnerability. This flaw allows authenticated users possessing system login permissions to utilize tenants that are not defined on the platform during workflow execution. To remediate this issue, users a...

CVE-2024-43115

Apache DolphinScheduler is vulnerable to Remote Code Execution (RCE) due to improper input validation within the alert script check. An authenticated user can submit crafted input to execute arbitrary shell commands on the server. This issue affects versions prior to 3.2.2 . Remediation requires ...

CVE-2025-62188

Apache DolphinScheduler versions 3.1. * are vulnerable to an Exposure of Sensitive Information to an unauthorized actor. This flaw may allow attackers to access sensitive data, specifically database credentials , through the actuator endpoint . To remediate this, users should upgrade to version ≥...

CVE-2026-42357

CVE-2026-42357 describes an Incorrect Authorization vulnerability in Apache DolphinScheduler. The issue allows users to access workflow instance information for projects they should not access. Affected versions are DolphinScheduler

CVE-2026-47340

CVE-2026-47340 describes an authorization flaw in Apache DolphinScheduler prior to 3.4.2 where authenticated users can access alert instances tied to alert groups they should not access. The issue affects DolphinScheduler up to version before 3.4.2; the recommended fix is upgrading to version 3.4...

CVE-2026-49050

Apache DolphinScheduler versions prior to 3.4.2 are vulnerable to an incorrect authorization flaw. A general user can exploit the /access-tokens endpoint to mint admin access tokens , potentially leading to unauthorized administrative access. To remediate this issue, users are recommended to upgr...