Medium severity · published Sep 29, 2026
CVE-2026-66083
Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata, depending on the fields returned by the endpoint.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Apache DolphinScheduler · Apache Software Foundation
before 3.4.3 · source: vendor
DO
Dolphinscheduler · Apache
before 3.4.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-66083
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-66083
vendor-advisory
https://lists.apache.org/thread/b6brfom0jmy9kdt40qrn6dq0x4v2wxdr
More from Apache DolphinScheduler
9.8
CVE-2026-32966
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
9.1
CVE-2026-32967
Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks
8.8
CVE-2026-82804
Apache DolphinScheduler: Command Injection in the Alert Script Plugin
8.8
CVE-2026-49050
Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens
8.1
CVE-2026-66087
Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint