https://seclists.org/oss-sec/2026/q4/97: CVE-2026-71895: Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to trieve Kubernetes Cdentials

Q: Who can exploit this issue?

An authenticated non-admin Apache DolphinScheduler user can exploit the missing authorization checks to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration.

Q: Which deployments are affected?

Apache DolphinScheduler versions from 3.2.0 before 3.4.3 are affected. Version 3.4.3 fixes the issue.

Q: What could an attacker do with the disclosed data?

The kubeconfig may contain credentials usable directly against the Kubernetes API outside DolphinScheduler. Impact depends on those credentials' permissions; broadly privileged or cluster-admin credentials could permit reading Secrets, creating pods, and establishing persistent cluster access.

Q: What should teams do if they suspect exposure?

Upgrade DolphinScheduler to 3.4.3. Because the disclosed kubeconfig may contain Kubernetes credentials, assess the permissions associated with those credentials and treat them as potentially exposed.

Published Oct 8, 2026

Updated

Affected Software

1 affected component

Apache Dolphinscheduler>=3.2.0<3.4.3

Frequently Asked Questions

Who can exploit this issue?

An authenticated non-admin Apache DolphinScheduler user can exploit the missing authorization checks to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration.

Which deployments are affected?

Apache DolphinScheduler versions from 3.2.0 before 3.4.3 are affected. Version 3.4.3 fixes the issue.

What could an attacker do with the disclosed data?

The kubeconfig may contain credentials usable directly against the Kubernetes API outside DolphinScheduler. Impact depends on those credentials' permissions; broadly privileged or cluster-admin credentials could permit reading Secrets, creating pods, and establishing persistent cluster access.

What should teams do if they suspect exposure?

Upgrade DolphinScheduler to 3.4.3. Because the disclosed kubeconfig may contain Kubernetes credentials, assess the permissions associated with those credentials and treat them as potentially exposed.