Apache DolphinScheduler vulnerabilities
6 known CVE vulnerabilities in Apache DolphinScheduler, translated and rated.
- CVE-2026-32967Critical
Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects versions before 3.4.2.
- CVE-2026-32966Critical
Missing authorization check in DataSource API leads to arbitrary data source metadata disclosure in Apache DolphinScheduler.
- CVE-2026-49050High
In Apache DolphinScheduler before 3.4.2, a general user can mint admin access tokens via /access-tokens. Users are recommended to upgrade to version 3.4.2, which fixes the issue.
- CVE-2026-47340Medium
In Apache DolphinScheduler before version 3.4.2, authenticated users can access alert instances associated with alert groups they do not have permission to access.
- CVE-2026-42357Medium
The Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
- CVE-2026-41280Medium
The Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects.