EUVD-2026-94808
GHSA-g89m-rq7v-96f2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Authenticated low-priv user (PR:L) over the network (AV:N/AC:L) reads credentials (C:H); the disclosure itself alters nothing, so I:N/A:N rather than the input's I:L.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
6Description PRE-NVD
Articles & Coverage 1
AnalysisAI
Broken authorization in Apache DolphinScheduler before 3.4.3 allows any authenticated user to retrieve connection details - including stored data source passwords - for data sources they are not authorized to access via the /unauth-datasource and /authed-datasource endpoints. Exploitation is network-reachable (AV:N), low complexity (AC:L), requires no user interaction (UI:N) and only a valid low-privileged account (PR:L), yielding high confidentiality impact (C:H) with no integrity or availability impact per our assessment; NVD/vendor scoring differs slightly by also crediting low integrity impact (I:L). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated DolphinScheduler account (PR:L) with network access to the API; it does NOT require admin rights or any special non-default configuration - the /unauth-datasource and /authed-datasource endpoints are standard data-source management APIs that simply omit the required per-data-source access-control check. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a broken-authorization flaw (CWE-863) in Apache DolphinScheduler where the /unauth-datasource and /authed-datasource endpoints fail to enforce per-data-source access controls and return connection details including passwords. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache DolphinScheduler 3.4.3, the vendor-released patch version that restores per-data-source authorization on the affected endpoints; this is the only complete fix and is confirmed available from the vendor (advisories: https://seclists.org/oss-sec/2026/q4/96, https://lists.apache.org/thread.html/9g0fx2kdqv9nj20k759shhly3vpg96mw, https://dolphinscheduler.apache.org). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache DolphinScheduler deployments, identify any instances running versions before 3.4.3, and restrict access to the /unauth-datasource and /authed-datasource endpoints through network controls or a reverse proxy where feasible; review authentication and access logs for unexpected data source credential retrieval by low-privileged accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today