- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 12 · 3 high, 5 medium
- Dependents
- 1
- Registry
- Maven Central
Advisories 12
- CVE-2026-49050High 8.8
Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens
Affected: fixed in 3.4.2.
- CVE-2026-47340Medium 6.5
Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with…
Affected: fixed in 3.4.2; fixed in 3.4.2.
- CVE-2026-32967Medium 6.5
Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks
Affected: fixed in 3.4.2; fixed in 3.4.2.
- CVE-2026-42357Medium 6.5
Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects…
Affected: fixed in 3.4.1; fixed in 3.4.2.
- CVE-2026-41280Medium 4.9
Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in…
Affected: fixed in 3.4.2; fixed in 3.4.2.
- CVE-2026-32966High 7.5
Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure
Affected: fixed in 3.4.2; fixed in 3.4.2.
- CVE-2026-23902High 8.1
Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.
Affected: fixed in 3.4.1.
- CVE-2023-50270Medium 6.5
Apache DolphinScheduler: Session do not expire after password change
Affected: from 1.3.8, through 3.2.0.
- CVE-2023-49620Unrated
Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for
Affected: fixed in 3.1.0.
- CVE-2023-49068Unrated
Apache DolphinScheduler: Information Leakage Vulnerability
Affected: fixed in 3.2.1.
- CVE-2023-25601Unrated
Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authentication
Affected: from 3.0.0, fixed in 3.1.2.
- CVE-2020-13922Unrated
Apache DolphinScheduler (incubating) Permission vulnerability
Affected: fixed in 1.3.2.