EUVD-2025-209572
GHSA-f786-9c63-8xr8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Primary rating from Vendor (apache) · only source for this CVE.
CVSS VectorVendor: apache
Lifecycle Timeline
7DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module.
This issue affects Apache DolphinScheduler:
Version >= 3.2.0 and < 3.3.1.
Attackers who can access the Master or Worker nodes can compromise the system by creating a StandardRpcRequest, injecting a malicious class type into it, and sending RPC requests to the DolphinScheduler Master/Worker nodes. Users are recommended to upgrade to version [3.3.1], which fixes the issue.
AnalysisAI
Unsafe deserialization in Apache DolphinScheduler RPC module (versions 3.2.0 to 3.3.0) allows authenticated network attackers to achieve remote code execution by injecting malicious class types into StandardRpcRequest messages sent to Master or Worker nodes. The vulnerability requires network access and valid credentials but carries moderate CVSS (6.3) with very low EPSS exploitation probability (0.02%), suggesting limited real-world weaponization despite the dangerous vulnerability class.
Technical ContextAI
Apache DolphinScheduler is a distributed workflow scheduler that uses an RPC module for inter-node communication between Master and Worker components. The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), a class 1 weakness where the RPC module deserializes arbitrary Java objects from network messages without proper validation. An attacker crafting a malicious StandardRpcRequest can inject a hostile class type that executes arbitrary code during deserialization. This affects CPE cpe:2.3:a:apache_software_foundation:apache_dolphinscheduler:*:*:*:*:*:*:*:* for versions 3.2.0 through 3.3.0. The RPC communication layer is a core architectural component used for task distribution and cluster coordination.
RemediationAI
Upgrade to Apache DolphinScheduler version 3.3.1 or later immediately, as confirmed by vendor advisory at https://lists.apache.org/thread/79s80h51r4z5d4l2xs5xy364rmmo1bw0. No workarounds are documented; patching is the primary remediation. Organizations unable to patch immediately should implement network-level controls: restrict RPC communication (typically ports 50010-50015 for Master/Worker) to trusted internal networks only, disable RPC access from untrusted sources, and enforce strong authentication and authorization on cluster access. Monitor RPC traffic for suspicious StandardRpcRequest messages or deserialization errors. Disable unused RPC features if supported by configuration. Test the upgrade in a non-production environment first, as DolphinScheduler RPC is critical to cluster operation.
More in Apache Dolphinscheduler
View allUnauthenticated remote disclosure of database credentials and other sensitive configuration data in Apache DolphinSchedu
Information disclosure in Apache DolphinScheduler before 3.4.3 allows any authenticated user to call the /datasources/un
Information disclosure in Apache DolphinScheduler 3.2.0 through versions before 3.4.3 lets any authenticated low-privile
Authentication bypass in Apache DolphinScheduler before 3.4.3 allows remote unauthenticated attackers to reach protected
Improper authorization in Apache DolphinScheduler before 3.4.3 allows an authenticated user to copy or move workflow def
Incorrect authorization in Apache DolphinScheduler before 3.4.3 allows an authenticated user who holds only read permiss
Improper authorization in Apache DolphinScheduler's sub-workflow task handling allows an authenticated user who lacks ac
Missing project-level authorization in the Task Group APIs of Apache DolphinScheduler allows an authenticated user to re
Authenticated shell command injection in Apache DolphinScheduler (all versions before 3.4.3) lets a user with permission
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today