Authorization Flaw in Apache DolphinScheduler Exposes Sensitive Data Sources

CVE-2026-71183

What is CVE-2026-71183?

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to access data sources they are not permitted to view. This occurs through the unsecured /unauth-datasource and /authed-datasource endpoints, which lack proper access control enforcement. As a result, sensitive connection information, including passwords, can be retrieved by unauthorized users. Successful exploitation of this vulnerability exposes sensitive data source details and might facilitate unauthorized access to the databases using the extracted credentials. Users are advised to update to version 3.4.3 or later to remediate the flaw.

References