Apache CVE-2025-62188

Primary remediation is upgrading Apache DolphinScheduler to version 3.2.0 or later, which contains vendor-supplied fixes per the official advisory at https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo. For environments unable to upgrade immediately, apply the documented configuration-based workaround by restricting Spring Boot Actuator exposure: set environment variable MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus or add the equivalent configuration to application.yaml (management.endpoints.web.exposure.include: health,metrics,prometheus). This workaround limits exposed endpoints to only health checks, metrics, and Prometheus endpoints, preventing access to sensitive environment and configuration data. Trade-off: the workaround may reduce observability if monitoring tools depend on other Actuator endpoints like /actuator/env or /actuator/configprops; verify monitoring integrations before applying. Additional compensating control: implement network-level access restrictions (firewall rules, security groups) to block external access to DolphinScheduler management ports if not operationally required, though this does not protect against internal network threats or authenticated users pivoting from other compromised systems.