https://seclists.org/oss-sec/2026/q4/96: CVE-2026-71183: Apache DolphinScheduler: Missing Authorization Checks Allow Disclosuof Data Source Information and Passwords

Q: Who can exploit this issue?

An authenticated Apache DolphinScheduler user can exploit it, even if that user does not have permission to access the targeted data source. The issue is exposed through the /unauth-datasource and /authed-datasource endpoints.

Q: What information could be exposed?

The affected endpoints can return sensitive data source connection information, including data source passwords. Disclosed credentials may allow unauthorized access to the underlying databases.

Q: Which deployments are affected?

Apache DolphinScheduler versions before 3.4.3 are affected. Version 3.4.3 fixes the authorization checks.

Published Oct 8, 2026

Updated

Affected Software

1 affected component

Apache Dolphinscheduler<3.4.3

Frequently Asked Questions

Who can exploit this issue?

An authenticated Apache DolphinScheduler user can exploit it, even if that user does not have permission to access the targeted data source. The issue is exposed through the /unauth-datasource and /authed-datasource endpoints.

What information could be exposed?

The affected endpoints can return sensitive data source connection information, including data source passwords. Disclosed credentials may allow unauthorized access to the underlying databases.

Which deployments are affected?

Apache DolphinScheduler versions before 3.4.3 are affected. Version 3.4.3 fixes the authorization checks.