CVE-2025-62188: Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-09 · updated 2026-10-07
Weakness: CWE-200

Description

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler. This vulnerability may allow unauthorized actors to access sensitive information, including database credentials. This issue affects Apache DolphinScheduler versions 3.1.*. Users are recommended to upgrade to: * version ≥ 3.2.0 if using 3.1.x As a temporary workaround, users who cannot upgrade immediately may restrict the exposed management endpoints by setting the following environment variable: ``` MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus ``` Alternatively, add the following configuration to the application.yaml file: ``` management: endpoints: web: exposure: include: health,metrics,prometheus ``` This issue has been reported as CVE-2023-48796: https://cveprocess.apache.org/cve5/CVE-2023-48796

Affected products

Apache Software Foundation Apache DolphinScheduler: from 3.1.0 before 3.2.0 — fixed in 3.2.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache DolphinScheduler 3.2.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-62188 or the next vulnerability affects your stack