Apache Software Foundation Apache DolphinScheduler

• CVE-2026-71896 Medium 6.5 Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information 0.3%
• CVE-2026-71895 High 7.1 Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials 0.2%
• CVE-2026-71183 High 7.1 Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords 0.2%
• CVE-2026-66087 High 8.1 Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint 0.3%
• CVE-2026-66084 High 8.1 Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint 0.3%
• CVE-2026-66082 Medium 6.5 Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow） 0.3%
• CVE-2026-71897 Medium 4.3 Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints 0.2%
• CVE-2026-71898 Medium 4.3 Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions 0.2%
• CVE-2026-71899 Medium 6.5 Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure 0.2%
• CVE-2026-78214 Medium 5.3 Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths 0.4%
• CVE-2026-81569 Medium 4.3 Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution 0.2%
• CVE-2026-82804 High 8.8 Apache DolphinScheduler: Command Injection in the Alert Script Plugin 0.5%
• CVE-2026-66083 Medium 6.5 Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource 0.3%
• CVE-2026-57590 High 8.1 Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations 0.2%
• CVE-2026-49050 High 8.8 Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens 0.6%
• CVE-2026-47340 Medium 6.5 Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access. 0.4%
• CVE-2026-32967 Medium 6.5 Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks 0.3%
• CVE-2026-42357 Medium 6.5 Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. 0.3%
• CVE-2026-41280 Medium 4.9 Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects 0.4%
• CVE-2026-32966 High 7.5 Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure 0.4%
• CVE-2026-23902 High 8.1 Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution. 0.4%
• CVE-2025-62233 Medium 6.3 Apache DolphinScheduler: Deserialization of untrusted data in RPC 0.5%
• CVE-2025-62188 High 7.5 Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint. 0.5%
• CVE-2024-43166 Critical 9.8 Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the i 0.5%
• CVE-2024-43115 High 8.8 Apache DolphinScheduler: Alert Script Attack 0.6%
• CVE-2024-43202 Critical 9.8 Apache DolphinScheduler: Remote Code Execution Vulnerability 2.1%
• CVE-2024-30188 High 8.8 Apache DolphinScheduler: Resource File Read And Write Vulnerability 6.0%
• CVE-2024-29831 High 8.8 Apache DolphinScheduler: RCE by arbitrary js execution 1.2%
• CVE-2024-23320 High 8.8 Apache DolphinScheduler: Arbitrary js execution as root for authenticated users 1.4%
• CVE-2023-51770 High 7.5 Apache DolphinScheduler: Arbitrary File Read Vulnerability 1.2%
• CVE-2023-50270 Medium 6.5 Apache DolphinScheduler: Session do not expire after password change 1.3%
• CVE-2023-49250 High 7.3 Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil 0.7%
• CVE-2023-49109 Critical 9.8 Remote Code Execution in Apache Dolphinscheduler 2.3%
• CVE-2023-49299 High 8.8 Apache DolphinScheduler: Arbitrary js execute as root for authenticated users 1.4%
• CVE-2023-49620 Unrated Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for 1.1%
• CVE-2023-49068 Unrated Apache DolphinScheduler: Information Leakage Vulnerability 1.1%
• CVE-2023-48796 Unrated Apache dolphinscheduler sensitive information disclosure 1.2%
• CVE-2023-25601 Unrated Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authentication 1.1%
• CVE-2022-45875 Critical 9.8 Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin 2.8%
• CVE-2022-26885 High 7.5 Apache DolphinScheduler config file read by task risk 1.4%
• CVE-2022-45462 Critical 9.8 Apache DolphinScheduler prior to 2.0.5 have command execution vulnerability 2.9%
• CVE-2022-34662 Medium 6.5 Apache DolphinScheduler prior to 3.0.0 allows path traversal 1.7%
• CVE-2022-26884 Medium 6.5 Apache DolphinScheduler exposes files without authentication 1.8%
• CVE-2022-25598 Unrated Apache DolphinScheduler user registration is vulnerable to ReDoS attacks 2.0%
• CVE-2021-27644 Unrated DolphinScheduler mysql jdbc connector parameters deserialize remote code execution 1.9%
• CVE-2020-13922 Unrated Apache DolphinScheduler (incubating) Permission vulnerability 1.8%