Authorization Flaw in Apache DolphinScheduler Affects Kubernetes Configuration Access

CVE-2026-71895

What is CVE-2026-71895?

An authorization flaw in Apache DolphinScheduler enables authenticated non-admin users to access sensitive Kubernetes configuration data. This compromised kubeconfig can expose critical credentials, potentially allowing unauthorized access to the Kubernetes API. If these credentials possess elevated permissions such as cluster-admin access, attackers could manipulate Kubernetes resources, read sensitive secrets, or establish persistent accessibility to the cluster. It is advised for users to upgrade to version 3.4.3 to remediate this issue effectively.

References