Skip to content
OpenAdvisories
High · 7.5 CVE-2026-32966 EUVD-2026-37580GHSA-r989-cjhx-3v49

Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure

Published Jun 17, 2026 · Updated Jun 17, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache DolphinScheduler Package: org.apache.dolphinscheduler:dolphinscheduler-api Ecosystem: Maven

Description

DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler.

This issue affects Apache DolphinScheduler: before 3.4.2.

Users are recommended to upgrade to version 3.4.2, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache DolphinScheduler < 3.4.2 3.4.2

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.dolphinscheduler:dolphinscheduler-api < 3.4.2 3.4.2 GHSA-r989-cjhx-3v49

References