Apache Apache Dolphinscheduler
46 CVEs affecting Apache Apache Dolphinscheduler. Latest disclosed: 2026-10-08. Critical: 7, High: 21.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32966 | Critical | 9.8 | 2026-06-17 | DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affects Apache DolphinSch… |
CVE-2024-43166 | Critical | 9.8 | 2025-09-03 | Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to up… |
CVE-2024-43202 | Critical | 9.8 | 2024-08-20 | Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.2. We recommend users to upgrade Apache… |
CVE-2023-49109 | Critical | 9.8 | 2024-02-20 | Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache… |
CVE-2022-45875 | Critical | 9.8 | 2023-01-04 | Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache Do… |
CVE-2022-45462 | Critical | 9.8 | 2022-11-23 | Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to versio… |
CVE-2026-32967 | Critical | 9.1 | 2026-06-17 | Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. U… |
CVE-2026-82804 | High | 8.8 | 2026-09-29 | The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substituti… |
CVE-2026-49050 | High | 8.8 | 2026-08-25 | General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade t… |
CVE-2024-43115 | High | 8.8 | 2025-09-03 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script. This issue aff… |
CVE-2024-29831 | High | 8.8 | 2024-08-12 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the ser… |
CVE-2024-23320 | High | 8.8 | 2024-02-23 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the ser… |
CVE-2023-49299 | High | 8.8 | 2023-12-30 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the ser… |
CVE-2021-27644 | High | 8.8 | 2021-11-01 | In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with… |
CVE-2026-66087 | High | 8.1 | 2026-10-08 | An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are not authorized to acc… |
CVE-2026-66084 | High | 8.1 | 2026-10-08 | An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are not authorized to a… |
CVE-2026-57590 | High | 8.1 | 2026-09-24 | A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authentica… |
CVE-2026-23902 | High | 8.1 | 2026-04-24 | Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined o… |
CVE-2024-30188 | High | 8.1 | 2024-08-12 | File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files. This issue affects Apache D… |
CVE-2025-62188 | High | 7.5 | 2026-04-09 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler. This vulnerability may allow unauthorized actor… |