Apache Dolphinscheduler
33 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Apache Dolphinscheduler, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Apache Dolphinscheduler CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 2 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 3 |
| 2026-05 | 0 |
| 2026-06 | 5 |
| 2026-07 | 0 |
| 2026-08 | 1 |
| 2026-09 | 1 |
Severity
How the 33 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical7
- High16
- Medium10
Latest CVEs
The 15 most recently published vulnerabilities affecting Apache Dolphinscheduler.
- CVE-2026-57590Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations8.1
- CVE-2026-49050Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens8.8
- CVE-2026-47340Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access.6.5
- CVE-2026-32967Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks9.1
- CVE-2026-42357Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.6.5
- CVE-2026-41280Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to delete task definitions in unauthorized projects4.9
- CVE-2026-32966Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure9.8
- CVE-2026-23902Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.8.1
- CVE-2025-62233Apache DolphinScheduler: Deserialization of untrusted data in RPC6.3
- CVE-2025-62188Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.7.5
- CVE-2024-43166Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes th...9.8
- CVE-2024-43115Apache DolphinScheduler: Alert Script Attack8.8
- CVE-2024-43202Apache DolphinScheduler: Remote Code Execution Vulnerability9.8
- CVE-2024-30188Apache DolphinScheduler: Resource File Read And Write Vulnerability8.1
- CVE-2024-29831Apache DolphinScheduler: RCE by arbitrary js execution8.8
Product grouping is registry-driven, with AI assist and human review. How it works