Dolphinscheduler (Apache) - vulnerabilities (CVEs)

34 CVEs, 1 in the last 30 days, 59 known versions, newest CVE from 2026-09-29. Vendor: Apache.

CVEs of Dolphinscheduler

CVE-2026-66083 - CVSS 6.5 (medium), 2026-09-29: The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain…
CVE-2026-49050 - CVSS 8.8 (high), 2026-08-25: General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to…
CVE-2026-47340 - CVSS 6.5 (medium), 2026-06-17: Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler. This issue…
CVE-2026-32967 - CVSS 9.1 (critical), 2026-06-17: Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2.…
CVE-2026-42357 - CVSS 6.5 (medium), 2026-06-17: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. This…
CVE-2026-41280 - CVSS 4.9 (medium), 2026-06-17: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache…
CVE-2026-32966 - CVSS 9.8 (critical), 2026-06-17: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affects Apache…
CVE-2026-23902 - CVSS 8.1 (high), 2026-04-24: Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined…
CVE-2025-62233 - CVSS 6.3 (medium), 2026-04-24: Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module. This issue affects Apache DolphinScheduler: Version >= 3.2.0 and <…
CVE-2025-62188 - CVSS 7.5 (high), 2026-04-09: An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler. This vulnerability may allow unauthorized…
CVE-2024-43166 - CVSS 9.8 (critical), 2025-09-03: Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to…
CVE-2024-43115 - CVSS 8.8 (high), 2025-09-03: Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue…
CVE-2024-43202 - CVSS 9.8 (critical), 2024-08-20: Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.2. We recommend users to upgrade Apache…
CVE-2024-30188 - CVSS 8.8 (high), 2024-08-12: File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files. This issue affects Apache…
CVE-2024-29831 - CVSS 8.8 (high), 2024-08-12: Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the…
CVE-2024-23320 - CVSS 8.8 (high), 2024-02-23: Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the…
CVE-2023-49250 - CVSS 7.3 (high), 2024-02-20: Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could…
CVE-2023-51770 - CVSS 7.5 (high), 2024-02-20: Arbitrary File Read Vulnerability in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache…
CVE-2023-50270 - CVSS 6.5 (medium), 2024-02-20: Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change. Users are recommended to upgrade to…
CVE-2023-49109 - CVSS 9.8 (critical), 2024-02-20: Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache…
CVE-2023-49299 - CVSS 8.8 (high), 2023-12-30: Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the…
CVE-2023-49620 - CVSS 6.5 (medium), 2023-11-30: Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task),…
CVE-2023-49068 - CVSS 7.5 (high), 2023-11-27: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1.…
CVE-2023-48796 - CVSS 7.5 (high), 2023-11-24: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may…
CVE-2023-25601 - CVSS 4.3 (medium), 2023-04-20: On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack…
CVE-2022-45875 - CVSS 9.8 (critical), 2023-01-04: Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache…
CVE-2022-26885 - CVSS 7.5 (high), 2022-11-24: When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher.
CVE-2022-45462 - CVSS 9.8 (critical), 2022-11-23: Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to…
CVE-2022-34662 - CVSS 6.5 (medium), 2022-11-01: When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. You could upgrade to…
CVE-2022-26884 - CVSS 6.5 (medium), 2022-10-28: Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.
CVE-2022-25598 - CVSS 7.5 (high), 2022-03-30: Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to…
CVE-2021-27644 - CVSS 8.8 (high), 2021-11-01: In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with…
CVE-2020-13922 - CVSS 6.5 (medium), 2021-01-11: Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.
CVE-2020-11974 - CVSS 9.8 (critical), 2020-12-18: In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.