CVE-2025-62188: Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler.
This vulnerability may allow unauthorized actors to access sensitive information, including database credentials.
This issue affects Apache DolphinScheduler versions 3.1..
Users are recommended to upgrade to:
version ≥ 3.2.0 if using 3.1.x
As a temporary workaround, users who cannot upgrade immediately may restrict the exposed management endpoints by setting the following environment variable:
MANAGEMENTENDPOINTSWEBEXPOSUREINCLUDE=health,metrics,prometheus
Alternatively, add the following configuration to the application.yaml file:
management: endpoints: web: exposure: include: health,metrics,prometheus
This issue has been reported as CVE-2023-48796:
https://cveprocess.apache.org/cve5/CVE-2023-48796
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62188?
CVE-2025-62188 is classified as a high severity vulnerability due to unauthorized access to sensitive information.
How do I fix CVE-2025-62188?
To fix CVE-2025-62188, upgrade to Apache DolphinScheduler version 3.2.0 or later.
What information can be exposed through CVE-2025-62188?
CVE-2025-62188 allows unauthorized users to potentially access sensitive information through the actuator endpoint.
Who is affected by CVE-2025-62188?
Users of Apache DolphinScheduler versions between 3.1.0 and 3.2.0 are affected by CVE-2025-62188.
Is CVE-2025-62188 being actively exploited?
As of now, there is no public information indicating that CVE-2025-62188 is being actively exploited.