What’s Vulnerable › Products

Apache Software Foundation Apache DolphinScheduler vulnerabilities

47 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 25 published in the last 12 months.

Check whether your Apache Software Foundation Apache DolphinScheduler version is affected

Latest Apache Software Foundation Apache DolphinScheduler vulnerabilities

• CVE-2026-71896 — Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information (CVSS 6.5)
• CVE-2026-71895 — Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials (CVSS 7.1)
• CVE-2026-71183 — Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords (CVSS 7.1)
• CVE-2026-66087 — Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint (CVSS 8.1)
• CVE-2026-66084 — Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint (CVSS 8.1)
• CVE-2026-66082 — Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow） (CVSS 6.5)
• CVE-2026-81569 — Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution (CVSS 4.3)
• CVE-2026-78214 — Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths (CVSS 5.3)
• CVE-2026-71899 — Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure (CVSS 6.5)
• CVE-2026-71898 — Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions (CVSS 4.3)
• CVE-2026-71897 — Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints (CVSS 4.3)
• CVE-2026-82804 — Apache DolphinScheduler: Command Injection in the Alert Script Plugin (CVSS 8.8)
• CVE-2026-66083 — Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource (CVSS 6.5)
• CVE-2026-57590 — Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations (CVSS 8.1)
• CVE-2026-49050 — Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens (CVSS 8.8)
• CVE-2026-47340 — Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access. (CVSS 6.5)
• CVE-2026-42357 — Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. (CVSS 6.5)
• CVE-2026-41280 — Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects (CVSS 4.9)
• CVE-2026-32967 — Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks (CVSS 9.1)
• CVE-2026-32966 — Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure (CVSS 9.8)
• CVE-2026-23902 — Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution. (CVSS 8.1)
• CVE-2025-62233 — Apache DolphinScheduler: Deserialization of untrusted data in RPC (CVSS 6.3)
• CVE-2025-62188 — Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint. (CVSS 7.5)
• CVE-2024-43166 — (CVSS 9.8)
• CVE-2024-43115 — Apache DolphinScheduler: Alert Script Attack (CVSS 8.8)