AD
Product
Apache DolphinScheduler
25
CVEs
0
On KEV
9.8
Max CVSS
13
New 30D
Severity mix
Critical 2High 9Medium 14Low 0
Watch
Add Apache DolphinScheduler to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-71896 | 6.5 | Oct 8 | Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information Affected: before 3.4.3 |
| CVE-2026-66082 | 6.5 | Oct 8 | Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow） Affected: before 3.4.3 |
| CVE-2026-71899 | 6.5 | Sep 29 | Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure Affected: 3.2.0 before 3.4.3 |
| CVE-2026-66083 | 6.5 | Sep 29 | Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource Affected: before 3.4.3 |
| CVE-2026-47340 | 6.5 | Jun 17 | Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access. Affected: before 3.4.2 |
| CVE-2026-42357 | 6.5 | Jun 17 | Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. Affected: before 3.4.1 |
| CVE-2022-34662 | 6.5 | Nov 1 | Apache DolphinScheduler prior to 3.0.0 allows path traversal Affected: Apache DolphinScheduler through 3.0.0-beta-1 |
| CVE-2022-26884 | 6.5 | Oct 28 | Apache DolphinScheduler exposes files without authentication Affected: Apache DolphinScheduler before 2.0.6 |
| CVE-2025-62233 | 6.3 | Apr 24 | Apache DolphinScheduler: Deserialization of untrusted data in RPC Affected: 3.2.0 before 3.3.1 |
| CVE-2026-78214 | 5.3 | Sep 29 | Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths Affected: before 3.4.3 |
| CVE-2026-41280 | 4.9 | Jun 17 | Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects Affected: before 3.4.2 |
| CVE-2026-71897 | 4.3 | Sep 29 | Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints Affected: before 3.4.3 |
| CVE-2026-71898 | 4.3 | Sep 29 | Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions Affected: before 3.4.3 |
| CVE-2026-81569 | 4.3 | Sep 29 | Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution Affected: before 3.4.3 |
Showing 14