https://seclists.org/oss-sec/2026/q3/992: CVE-2026-66083: Apache DolphinScheduler: Unauthorized Disclosuof Data Source Information via /datasources/unauth-datasource

Q: Who can exploit this issue?

An authenticated Apache DolphinScheduler user can invoke the affected endpoint. The issue does not describe unauthenticated access.

Q: What information could be exposed?

Unauthorized users may obtain information about data sources they are not permitted to access. Depending on the fields returned, this can include data source configuration and other sensitive metadata.

Q: Which deployments are affected?

Apache DolphinScheduler versions before 3.4.3 are affected. The provided information does not identify any configuration prerequisite or exception.

Q: What should teams do to remediate the issue?

Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the authorization enforcement issue.

Published Sep 29, 2026

Updated

Affected Software

1 affected component

Apache Dolphinscheduler<3.4.3

Frequently Asked Questions

Who can exploit this issue?

An authenticated Apache DolphinScheduler user can invoke the affected endpoint. The issue does not describe unauthenticated access.

What information could be exposed?

Unauthorized users may obtain information about data sources they are not permitted to access. Depending on the fields returned, this can include data source configuration and other sensitive metadata.

Which deployments are affected?

Apache DolphinScheduler versions before 3.4.3 are affected. The provided information does not identify any configuration prerequisite or exception.

What should teams do to remediate the issue?

Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the authorization enforcement issue.