Command Execution Vulnerability in Apache DolphinScheduler

CVE-2026-82804

What is CVE-2026-82804?

A command injection vulnerability exists in Apache DolphinScheduler due to inadequate neutralization of shell metacharacters in the scriptPath parameter. An authenticated user can exploit this flaw by crafting a resource filename that includes shell command substitution syntax (e.g., $(...)). When the filename is passed to the Alert Script plugin's /test-send endpoint, the system may execute the injected shell command with the privileges of the DolphinScheduler service process, potentially allowing attackers to gain unauthorized access to sensitive operations. Users are urged to upgrade to version 3.4.3, which incorporates necessary mitigations.

References