AD
Product
Apache DolphinScheduler
25
CVEs
0
On KEV
9.8
Max CVSS
13
New 30D
Severity mix
Critical 2High 9Medium 14Low 0
Watch
Add Apache DolphinScheduler to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-82804 | 8.8 | Sep 29 | Apache DolphinScheduler: Command Injection in the Alert Script Plugin Affected: before 3.4.3 |
| CVE-2026-49050 | 8.8 | Aug 25 | Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens Affected: before 3.4.2 |
| CVE-2026-66087 | 8.1 | Oct 8 | Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint Affected: before 3.4.3 |
| CVE-2026-66084 | 8.1 | Oct 8 | Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint Affected: before 3.4.3 |
| CVE-2026-57590 | 8.1 | Sep 24 | Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations Affected: before 3.4.3 |
| CVE-2026-23902 | 8.1 | Apr 24 | Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution. Affected: before 3.4.1 |
| CVE-2025-62188 | 7.5 | Apr 9 | Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint. Affected: 3.1.0 before 3.2.0 |
| CVE-2026-71895 | 7.1 | Oct 8 | Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials Affected: 3.1.0 before 3.4.3 |
| CVE-2026-71183 | 7.1 | Oct 8 | Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords Affected: before 3.4.3 |
Showing 9