CVE-2026-82804
HighCVSS 8.8Summary
The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitution syntax, such as $(...), and subsequently supplying the resulting path to the Alert Script plugin's /test-send endpoint. When the alert script is executed, the shell interprets the injected command, resulting in arbitrary command execution with the privileges of the DolphinScheduler service process.
Risk Assessment
An authenticated user can execute arbitrary commands in the context of the DolphinScheduler service, potentially leading to server compromise, data theft, or lateral movement. The issue affects Apache DolphinScheduler before 3.4.3.
Recommendation
Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the issue. Until then, restrict access to the /test-send endpoint and review permissions of users able to create resources.
Other vulnerabilities in Apache DolphinScheduler
See all- CVE-2026-81569Medium
An improper authorization vulnerability exists in the handling of sub-workflow tasks in Apache DolphinScheduler before 3.4.3. An authenticated user who does not have permission to access a target project can reference and invoke a workflow belonging to that project through a sub-workflow task. The system does not properly verify whether the user has permission to execute the referenced workflow or access its project, allowing bypass of project-level authorization controls and execution of workflows in unauthorized projects.
- CVE-2026-78214Medium
An authentication bypass vulnerability exists in the protection of Actuator endpoints in Apache DolphinScheduler before 3.4.3. The application determines whether authentication is required by matching the incoming request path against protected Actuator paths. By sending a specially crafted request containing a percent-encoded path, a remote unauthenticated attacker can cause the security check to fail to recognize the request as targeting a protected endpoint. As a result, the attacker may bypass authentication and access otherwise restricted Actuator endpoints, potentially exposing operational or configuration information and, depending on the enabled endpoints and application configuration, allow access to sensitive management functionality.
- CVE-2026-71898Medium
An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow instance in that project through the PUT /projects/{projectCode}/workflow-instances/{id} endpoint. The endpoint does not enforce the write permission required for this operation.
- CVE-2026-71897Medium
An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on workflows in projects for which they lack the required permissions. This may allow the user to copy or move workflows from unauthorized projects.
- CVE-2026-66083Medium
The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata. Affects Apache DolphinScheduler before 3.4.3.
- CVE-2026-32967Critical
Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects versions before 3.4.2.
- CVE-2026-32966Critical
Missing authorization check in DataSource API leads to arbitrary data source metadata disclosure in Apache DolphinScheduler.
- CVE-2026-71899Medium
A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler. The API does not properly verify whether the authenticated user has permission to access the workflows being queried, allowing users to retrieve workflow data outside their authorized project scope.
- CVE-2026-57590High
A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue affects Apache DolphinScheduler before 3.4.3.
- CVE-2026-49050High
In Apache DolphinScheduler before 3.4.2, a general user can mint admin access tokens via /access-tokens. Users are recommended to upgrade to version 3.4.2, which fixes the issue.
Original NVD description (English source)
The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitution syntax, such as $(...), and subsequently supplying the resulting path to the Alert Script plugin's /test-send endpoint. When the alert script is executed, the shell interprets the injected command, resulting in arbitrary command execution with the privileges of the DolphinScheduler service process. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS