- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 17 · 3 critical, 7 high, 4 medium
- Dependents
- 0
- Registry
- Maven Central
Advisories 17
- CVE-2026-23902High 8.1
Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.
Affected: fixed in 3.4.1.
- CVE-2025-62233Medium 6.3
Apache DolphinScheduler: Deserialization of untrusted data in RPC
Affected: from 3.2.0, fixed in 3.3.1.
- CVE-2025-62188High 7.5
Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.
Affected: from 3.1.0, fixed in 3.2.0.
- CVE-2024-43166Critical 9.8
Incorrect Default Permissions vulnerability in Apache DolphinScheduler.
Affected: fixed in 3.3.1.
- CVE-2024-43115High 8.8
Apache DolphinScheduler: Alert Script Attack
Affected: fixed in 3.2.2.
- CVE-2024-30188High 8.8
Apache DolphinScheduler: Resource File Read And Write Vulnerability
Affected: from 3.1.0, fixed in 3.2.2.
- CVE-2024-29831High 8.8
Apache DolphinScheduler: RCE by arbitrary js execution
Affected: fixed in 3.2.2.
- CVE-2023-51770High 7.5
Apache DolphinScheduler: Arbitrary File Read Vulnerability
Affected: fixed in 3.2.1.
- CVE-2023-50270Medium 6.5
Apache DolphinScheduler: Session do not expire after password change
Affected: from 1.3.8, fixed in 3.2.1.
- CVE-2023-49250High 7.3
Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil
Affected: fixed in 3.2.1.
- CVE-2023-49109Critical 9.8
Remote Code Execution in Apache Dolphinscheduler
Affected: from 3.0.0, fixed in 3.2.1.
- CVE-2023-48796Unrated
Apache dolphinscheduler sensitive information disclosure
Affected: from 3.0.0, fixed in 3.0.2.
- CVE-2022-45875Critical 9.8
Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin
Affected: fixed in 3.0.2; from 3.1.0, fixed in 3.1.1.
- CVE-2022-34662Medium 6.5
Apache DolphinScheduler prior to 3.0.0 allows path traversal
Affected: fixed in 3.0.0.
- CVE-2022-26884Medium 6.5
Apache DolphinScheduler exposes files without authentication
Affected: fixed in 2.0.6.
Show all 17 advisoriesShow fewer advisories
- CVE-2022-25598Unrated
Apache DolphinScheduler user registration is vulnerable to ReDoS attacks
Affected: fixed in 2.0.5.
- CVE-2020-11974Unrated
In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.
Affected: fixed in 1.3.0.