What is the CVSS score of EUVD-2026-37580?

EUVD-2026-37580 has a CVSS 3.1 base score of 7.5 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache DolphinScheduler are affected by EUVD-2026-37580?

Apache DolphinScheduler contains an authorization flaw in its DataSource API that exposes database connection metadata-including hostnames, credentials, and ports-to authenticated low-privilege users…. A patch is available.

How to fix or mitigate EUVD-2026-37580?

Within 24 hours: Inventory all Apache DolphinScheduler instances and identify current versions; determine which systems have versions before 3.4.2. Within 7 days: Restrict DataSource API access to administrative users only via network controls or Web Application Firewall rules; enable audit logging on all DataSource API queries to detect unauthorized access. Within 30 days: Subscribe to Apache Security Advisories for patch release; prepare upgrade plan to version 3.4.2 once available.

Apache DolphinScheduler EUVD-2026-37580

| CVE-2026-32966 CRITICAL

Incorrect Authorization (CWE-863)

2026-06-17

GHSA-r989-cjhx-3v49

Apache Information Disclosure

7.5

CVSS 3.1 · CISA-ADP

Severity by source

Vendor (CNA) PRIMARY

MEDIUM

qualitative

CISA-ADP

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network API, no complexity; PR:L because authentication is required; C:H for sensitive infrastructure metadata; no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorCISA-ADP

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 17, 2026 - 11:01 EUVD

Analysis Generated

Jun 17, 2026 - 02:21 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on org.apache.dolphinscheduler:dolphinscheduler-api (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.4.2.

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Authorization Bypass in Apache DolphinScheduler DataSource API - CVE-2026-32966 Jun 18, 2026

AnalysisAI

Missing authorization check in the Apache DolphinScheduler DataSource API exposes arbitrary data source metadata to users who lack permission to view it, affecting all versions before 3.4.2. Authenticated users with low-privilege access can query the DataSource API and retrieve connection metadata - such as hostnames, ports, database names, and usernames - belonging to data sources they are not authorized to access. No public exploit or active exploitation has been identified at time of analysis, and the Apache Software Foundation has rated this moderate severity, consistent with a confidentiality-only impact against an internal platform.

Technical ContextAI

Apache DolphinScheduler (org.apache.dolphinscheduler:dolphinscheduler-api) is an open-source distributed workflow scheduling platform used to orchestrate data pipelines. It exposes a REST API layer through the dolphinscheduler-api module, which manages data source registrations - database connections, cloud storage endpoints, and similar resources that worker tasks use at runtime. The DataSource API is responsible for CRUD operations and metadata retrieval on these registered sources. The root cause is a missing authorization check (consistent with CWE-862: Missing Authorization) on one or more DataSource API endpoints, meaning the application authenticates the caller but fails to verify whether that caller has the right to view a specific data source's metadata. This is a horizontal privilege escalation pattern: a low-privilege user can read metadata owned by or restricted to other tenants or higher-privilege users within the same DolphinScheduler instance.

RemediationAI

Upgrade Apache DolphinScheduler to version 3.4.2, which contains the authorization fix per the Apache project's own recommendation. The vendor advisory at https://dolphinscheduler.apache.org and the oss-security post at https://seclists.org/oss-sec/2026/q2/953 confirm 3.4.2 as the fixed release. If an immediate upgrade is not feasible, restrict network-level access to the DolphinScheduler API to trusted internal networks or VPN only, reducing the pool of potential callers - note this does not fix the missing authorization check but limits exposure to already-authenticated internal users. Additionally, audit existing DolphinScheduler user accounts and remove any accounts that should not have platform access, minimizing the authenticated attacker surface until patching is complete. No workaround that disables only the affected DataSource API endpoints has been documented by the vendor.