Dolphinscheduler
Approved changes feed: RSS · Atom
cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Dolphinscheduler (e50278c8-ec59-51a3-8889-26ed41328497) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/dolphinscheduler |
purl2cpe | 2026-06-01 10:14:26.897046 |
pkg:docker/apache/dolphinscheduler |
purl2cpe | 2026-06-01 10:14:26.897050 |
pkg:github/apache/dolphinscheduler |
purl2cpe | 2026-06-01 10:14:26.897052 |
pkg:maven/org.apache.dolphinscheduler/dolphinscheduler |
purl2cpe | 2026-06-01 10:14:26.897055 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-23902 |
vulnerable | 2026-06-08 07:51:16.425172 |
Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.
Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.
This issue affects Apache DolphinScheduler versions prior to 3.4.1.
Users are recommended to upgrade to version 3.4.1, which fixes this issue.
Published: 2026-04-24T10:56:18.289Z
Updated: 2026-04-24T18:33:34.025Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-62233 |
vulnerable | 2026-06-08 07:37:28.929803 |
Apache DolphinScheduler: Deserialization of untrusted data in RPC
Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module.
This issue affects Apache DolphinScheduler:
Version >= 3.2.0 and < 3.3.1.
Attackers who can access the Master or Worker nodes can compromise the system by creating a StandardRpcRequest, injecting a malicious class type into it, and sending RPC requests to the DolphinScheduler Master/Worker nodes.
Users are recommended to upgrade to version [3.3.1], which fixes the issue.
Published: 2026-04-24T10:54:55.162Z
Updated: 2026-04-24T16:09:59.535Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-62188 |
vulnerable | 2026-06-08 07:37:28.764422 |
Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler.
This vulnerability may allow unauthorized actors to access sensitive information, including database credentials.
This issue affects Apache DolphinScheduler versions 3.1.*.
Users are recommended to upgrade to:
* version ≥ 3.2.0 if using 3.1.x
As a temporary workaround, users who cannot upgrade immediately may restrict the exposed management endpoints by setting the following environment variable:
```
MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus
```
Alternatively, add the following configuration to the application.yaml file:
```
management:
endpoints:
web:
exposure:
include: health,metrics,prometheus
```
This issue has been reported as CVE-2023-48796:
https://cveprocess.apache.org/cve5/CVE-2023-48796
Published: 2026-04-09T09:27:13.570Z
Updated: 2026-04-09T13:57:33.406Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-43202 |
vulnerable | 2026-06-08 06:45:49.858600 |
Apache DolphinScheduler: Remote Code Execution Vulnerability
Exposure of Remote Code Execution in Apache Dolphinscheduler.
This issue affects Apache DolphinScheduler: before 3.2.2.
We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue.
Published: 2024-08-20T07:29:43.170Z
Updated: 2024-08-20T15:02:42.396Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-43166 |
vulnerable | 2026-06-08 06:45:49.732426 |
Details available
Incorrect Default Permissions vulnerability in Apache DolphinScheduler.
This issue affects Apache DolphinScheduler: before 3.2.2.
Users are recommended to upgrade to version 3.3.1, which fixes the issue.
Published: 2025-09-03T09:10:24.401Z
Updated: 2025-11-04T21:08:48.628Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-43115 |
vulnerable | 2026-06-08 06:45:49.610084 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-30188 |
vulnerable | 2026-06-08 06:35:29.164290 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29831 |
vulnerable | 2026-06-08 06:33:29.421134 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-23320 |
vulnerable | 2026-06-08 06:29:37.284915 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-51770 |
vulnerable | 2026-06-08 06:17:53.891350 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-50270 |
vulnerable | 2026-06-08 06:16:15.876525 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-49620 |
vulnerable | 2026-06-08 06:14:29.262212 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-49299 |
vulnerable | 2026-06-08 06:14:28.995129 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-49250 |
vulnerable | 2026-06-08 06:14:28.885974 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-49109 |
vulnerable | 2026-06-08 06:14:28.506542 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-49068 |
vulnerable | 2026-06-08 06:14:28.369666 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-48796 |
vulnerable | 2026-06-08 06:14:28.174072 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-25601 |
vulnerable | 2026-06-08 05:56:09.326014 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-45875 |
vulnerable | 2026-06-08 05:50:37.444503 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-45462 |
vulnerable | 2026-06-08 05:50:36.419399 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-34662 |
vulnerable | 2026-06-08 05:46:02.558318 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-26885 |
vulnerable | 2026-06-08 05:41:54.395577 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-26884 |
vulnerable | 2026-06-08 05:41:54.395222 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-25598 |
vulnerable | 2026-06-08 05:41:46.021190 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-27644 |
vulnerable | 2026-06-08 05:31:22.000309 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.