Apache Dolphinscheduler vulnerabilities
34 vulnerabilities
Known vulnerabilities in Apache Dolphinscheduler, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-27644apache software foundationapache dolphinscheduler+2
EPSS score1.92%
In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)CVE-2025-62188apache software foundationapache dolphinscheduler+2EPSS score0.52%
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler.
This vulnerability may allow unauthorized actors to access sensitive information, including database credentials.
This issue affects Apache DolphinScheduler versions 3.1.*.
Users are recommended to upgrade to:
* version ≥ 3.2.0 if using 3.1.x
As a temporary workaround, users who cannot upgrade immediately may restrict the exposed management endpoints by setting the following environment variable:
```
MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus
```
Alternatively, add the following configuration to the application.yaml file:
```
management:
endpoints:
web:
exposure:
include: health,metrics,prometheus
```
This issue has been reported as CVE-2023-48796:
https://cveprocess.apache.org/cve5/CVE-2023-48796CVE-2025-62233apache software foundationapache dolphinscheduler+3EPSS score0.54%
Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module.
This issue affects Apache DolphinScheduler:
Version >= 3.2.0 and < 3.3.1.
Attackers who can access the Master or Worker nodes can compromise the system by creating a StandardRpcRequest, injecting a malicious class type into it, and sending RPC requests to the DolphinScheduler Master/Worker nodes.
Users are recommended to upgrade to version [3.3.1], which fixes the issue.CVE-2020-13922apache software foundationapache dolphinscheduler+3EPSS score1.75%
Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.CVE-2020-11974apachedolphinscheduler+1EPSS score8.12%
In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.CVE-2022-26885apache software foundationapache dolphinscheduler+2EPSS score1.32%
When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher.CVE-2022-26884apache software foundationapache dolphinscheduler+2EPSS score1.64%
Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.CVE-2022-25598apache software foundationapache dolphinscheduler+3EPSS score1.98%
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.CVE-2022-45875apache software foundationapache dolphinscheduler+3EPSS score2.66%
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions.
This attack can be performed only by authenticated users which can login to DS.CVE-2022-45462apache software foundationapache dolphinscheduler+2EPSS score2.83%
Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higherCVE-2022-34662apache software foundationapache dolphinscheduler+2EPSS score1.56%
When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. You could upgrade to version 3.0.0 or higherCVE-2024-43115apache software foundationapache dolphinscheduler+2EPSS score0.51%
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script.
This issue affects Apache DolphinScheduler: before 3.2.2.
Users are recommended to upgrade to version 3.3.1, which fixes the issue.CVE-2024-43166apache software foundationapache dolphinscheduler+2EPSS score0.53%
Incorrect Default Permissions vulnerability in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.2.2.
Users are recommended to upgrade to version 3.3.1, which fixes the issue.CVE-2024-43202apache software foundationapache dolphinscheduler+2EPSS score2.15%
Exposure of Remote Code Execution in Apache Dolphinscheduler.
This issue affects Apache DolphinScheduler: before 3.2.2.
We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue.CVE-2024-29831apache software foundationapache dolphinscheduler+2EPSS score1.18%
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.CVE-2024-30188apache software foundationapache dolphinscheduler+2EPSS score5.99%
File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files.
This issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2.
Users are recommended to upgrade to version 3.2.2, which fixes the issue.CVE-2024-23320apache software foundationapache dolphinscheduler+2EPSS score1.39%
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.
This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it.
This issue affects Apache DolphinScheduler: until 3.2.1.
Users are recommended to upgrade to version 3.2.1, which fixes the issue.CVE-2026-41280apache software foundationapache dolphinscheduler+2EPSS score0.54%
Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects
This issue affects Apache DolphinScheduler versions prior to 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes this issue.CVE-2026-47340apache software foundationapache dolphinscheduler+2EPSS score0.55%
Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes the issue.CVE-2026-42357apache software foundationapache dolphinscheduler+2EPSS score0.49%
Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
This issue affects Apache DolphinScheduler versions prior to 3.4.2.
Users are recommended to upgrade to version 3.4.2, which fixes this issue.