CVE-2026-66083: Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource
The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata, depending on the fields returned by the endpoint.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache DolphinSchedulerto a version that resolves this vulnerability.Fixed in 3.4.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Apache DolphinScheduler user can exploit it. The issue is an authorization failure, so the attacker does not need permission to access the specific data sources whose information is disclosed.
Which deployments are affected?
Apache DolphinScheduler versions before 3.4.3 are affected. The provided information does not identify any configuration prerequisite beyond an authenticated user being able to invoke the endpoint.
What should teams do if they cannot upgrade immediately?
The provided information recommends upgrading to version 3.4.3, which fixes the issue. No alternative mitigation or workaround is specified.
How can administrators assess possible exposure?
Review access to the /datasources/unauth-datasource endpoint and determine whether authenticated users could invoke it. The provided information does not include logging indicators or a method to confirm whether unauthorized data source information was retrieved.