https://seclists.org/oss-sec/2026/q3/998: CVE-2026-82804: Apache DolphinScheduler: Command Injection in the Alert Script Plugin

Q: Who can exploit this issue?

An authenticated Apache DolphinScheduler user can exploit it. The user must be able to create a resource with a filename containing shell command substitution syntax and provide its path to the Alert Script plugin's /test-send endpoint.

Q: What level of access does successful exploitation provide?

Successful exploitation allows arbitrary command execution with the privileges of the DolphinScheduler service process.

Q: Are default deployments affected?

The available information does not state whether the Alert Script plugin or its /test-send endpoint is enabled or accessible in a default deployment. The issue affects DolphinScheduler versions before 3.4.3 when the described plugin workflow can be used.

Q: What should be done if the installation is vulnerable?

Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the issue. If an upgrade cannot be performed immediately, restrict authenticated users' ability to create resources with attacker-controlled filenames and access the Alert Script plugin's /test-send endpoint where possible.

Published Sep 29, 2026

Updated

Affected Software

1 affected component

Apache Dolphinscheduler<3.4.3

Frequently Asked Questions

Who can exploit this issue?

An authenticated Apache DolphinScheduler user can exploit it. The user must be able to create a resource with a filename containing shell command substitution syntax and provide its path to the Alert Script plugin's /test-send endpoint.

What level of access does successful exploitation provide?

Successful exploitation allows arbitrary command execution with the privileges of the DolphinScheduler service process.

Are default deployments affected?

The available information does not state whether the Alert Script plugin or its /test-send endpoint is enabled or accessible in a default deployment. The issue affects DolphinScheduler versions before 3.4.3 when the described plugin workflow can be used.

What should be done if the installation is vulnerable?

Upgrade Apache DolphinScheduler to version 3.4.3, which fixes the issue. If an upgrade cannot be performed immediately, restrict authenticated users' ability to create resources with attacker-controlled filenames and access the Alert Script plugin's /test-send endpoint where possible.