DO
Product
Dolphinscheduler
34
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 8High 15Medium 11Low 0
Watch
Add Dolphinscheduler to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-32966 | 9.8 | Jun 17 | Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure Affected: before 3.4.2 |
| CVE-2024-43166 | 9.8 | Sep 3 | Incorrect Default Permissions vulnerability in Apache DolphinScheduler Affected: before 3.2.2 |
| CVE-2024-43202 | 9.8 | Aug 20 | Exposure of Remote Code Execution in Apache Dolphinscheduler Affected: 3.0.0 before 3.2.2 |
| CVE-2023-49109 | 9.8 | Feb 20 | Exposure of Remote Code Execution in Apache Dolphinscheduler Affected: 3.0.0 before 3.2.1 |
| CVE-2022-45875 | 9.8 | Jan 4 | Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability Affected: before 3.0.2; 3.1.0 |
| CVE-2022-45462 | 9.8 | Nov 23 | Alarm instance management has command injection when there is a specific command configured Affected: before 2.0.6 |
| CVE-2020-11974 | 9.8 | Dec 18 | In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database Affected: 1.2.0; 1.2.1 |
| CVE-2026-32967 | 9.1 | Jun 17 | Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks Affected: before 3.4.2 |
| CVE-2026-49050 | 8.8 | Aug 25 | Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens Affected: before 3.4.2 |
| CVE-2024-43115 | 8.8 | Sep 3 | Improper Input Validation vulnerability in Apache DolphinScheduler Affected: before 3.2.2 |
| CVE-2024-29831 | 8.8 | Aug 12 | Improper Input Validation vulnerability in Apache DolphinScheduler Affected: before 3.2.2 |
| CVE-2024-23320 | 8.8 | Feb 23 | Improper Input Validation vulnerability in Apache DolphinScheduler Affected: before 3.2.1 |
| CVE-2023-49299 | 8.8 | Dec 30 | Improper Input Validation vulnerability in Apache DolphinScheduler Affected: before 3.1.9 |
| CVE-2021-27644 | 8.8 | Nov 1 | In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center Affected: before 1.3.6 |
| CVE-2026-23902 | 8.1 | Apr 24 | Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution. Affected: before 3.4.1 |
| CVE-2024-30188 | 8.1 | Aug 12 | File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files Affected: 3.1.0 before 3.2.2 |
| CVE-2025-62188 | 7.5 | Apr 9 | Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint. Affected: 3.1.0 before 3.2.0 |
| CVE-2023-51770 | 7.5 | Feb 20 | Arbitrary File Read Vulnerability in Apache Dolphinscheduler Affected: 1.2.0 before 3.2.1 |
| CVE-2023-49068 | 7.5 | Nov 27 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1 Affected: before 3.2.1 |
| CVE-2023-48796 | 7.5 | Nov 24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler Affected: 3.0.0 before 3.0.2 |
| CVE-2022-26885 | 7.5 | Nov 24 | When using tasks to read config files, there is a risk of database password disclosure Affected: before 2.0.6 |
| CVE-2022-25598 | 7.5 | Mar 30 | Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or… Affected: before 2.0.5 |
| CVE-2023-49250 | 7.3 | Feb 20 | Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the… Affected: before 3.2.1 |
| CVE-2026-66083 | 6.5 | Sep 29 | Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource Affected: before 3.4.3 |
| CVE-2026-47340 | 6.5 | Jun 17 | Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access. Affected: before 3.4.2 |
| CVE-2026-42357 | 6.5 | Jun 17 | Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. Affected: before 3.4.2 |
| CVE-2023-50270 | 6.5 | Feb 20 | Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change Affected: 1.3.8 before 3.2.1 |
| CVE-2023-49620 | 6.5 | Nov 30 | Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access… Affected: before 3.1.0 |
| CVE-2022-34662 | 6.5 | Nov 1 | Apache DolphinScheduler prior to 3.0.0 allows path traversal Affected: before 3.0.0 |
| CVE-2022-26884 | 6.5 | Oct 28 | Apache DolphinScheduler exposes files without authentication Affected: before 2.0.6 |
| CVE-2020-13922 | 6.5 | Jan 11 | Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface Affected: 1.2.0; 1.2.1; 1.3.1 |
| CVE-2025-62233 | 6.3 | Apr 24 | Apache DolphinScheduler: Deserialization of untrusted data in RPC Affected: 3.2.0 before 3.3.1 |
| CVE-2026-41280 | 4.9 | Jun 17 | Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects Affected: before 3.4.2 |
| CVE-2023-25601 | 4.3 | Apr 20 | On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication Affected: 3.0.0 before 3.1.2 |
Showing 34