Deserialization Vulnerability in Apache DolphinScheduler by Apache

CVE-2025-62233

What is CVE-2025-62233?

A deserialization vulnerability exists in Apache DolphinScheduler's RPC module, which could allow attackers with access to Master or Worker nodes to execute unauthorized actions. By injecting a malicious class type into a StandardRpcRequest and sending it to the nodes, the attackers might compromise system integrity. It is essential for users operating versions prior to 3.3.1 to upgrade to mitigate this risk.

References