Apache Dolphinscheduler vulnerabilities

34 CVEs affecting Apache Dolphinscheduler, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-66083, published 2026-09-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-11974, published 2020-12-18. Critical severity, CVSS 9.8. EPSS: 8.1% chance of exploitation in the next 30 days. In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.
CVE-2024-30188, published 2024-08-12. High severity, CVSS 8.1. EPSS: 6% chance of exploitation in the next 30 days. File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler: from 3.1.0 before…
CVE-2022-45462, published 2022-11-23. Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days. Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher
CVE-2022-45875, published 2023-01-04. Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days. Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior…
CVE-2023-49109, published 2024-02-20. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1,…
CVE-2024-43202, published 2024-08-20. Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days. Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.2. We recommend users to upgrade Apache DolphinScheduler to version 3.2.2,…
CVE-2022-25598, published 2022-03-30. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
CVE-2021-27644, published 2021-11-01. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)
CVE-2020-13922, published 2021-01-11. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.
CVE-2022-26884, published 2022-10-28. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.

Latest

CVE-2026-66083, published 2026-09-29. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not…
CVE-2026-49050, published 2026-08-25. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.
CVE-2026-47340, published 2026-06-17. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Allow authenticated users to access alert instances associated with alert groups they do not have permission to access. in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before…
CVE-2026-42357, published 2026-06-17. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. This issue affects Apache DolphinScheduler…
CVE-2026-41280, published 2026-06-17. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects This issue affects Apache DolphinScheduler versions prior to…
CVE-2026-32967, published 2026-06-17. Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days. Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to…
CVE-2026-32966, published 2026-06-17. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are…
CVE-2026-23902, published 2026-04-24. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow…
CVE-2025-62233, published 2026-04-24. Medium severity, CVSS 6.3. EPSS: 0.5% chance of exploitation in the next 30 days. Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module. This issue affects Apache DolphinScheduler: Version >= 3.2.0 and < 3.3.1. Attackers who can access the…
CVE-2025-62188, published 2026-04-09. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler. This vulnerability may allow unauthorized actors to access sensitive information,…