EUVD-2026-37580Severity by source
Network API, no complexity; PR:L because authentication is required; C:H for sensitive infrastructure metadata; no integrity or availability impact.
Lifecycle Timeline
2Description PRE-NVD
AnalysisAI
Missing authorization check in the Apache DolphinScheduler DataSource API exposes arbitrary data source metadata to users who lack permission to view it, affecting all versions before 3.4.2. Authenticated users with low-privilege access can query the DataSource API and retrieve connection metadata - such as hostnames, ports, database names, and usernames - belonging to data sources they are not authorized to access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active, authenticated session on the Apache DolphinScheduler platform - an attacker must hold a valid user account (any privilege level) on the target instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The Apache project rates this moderate, which is consistent with a network-accessible, low-complexity missing authorization flaw that yields confidentiality impact only. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated DolphinScheduler user with a low-privilege tenant account sends unapproved API requests to the DataSource metadata endpoint, specifying data source IDs belonging to other tenants or admin-owned sources. Because the authorization check is absent, the server returns full metadata - hostnames, ports, schema names, and usernames - for those sources without verifying ownership. … |
| Remediation | Upgrade Apache DolphinScheduler to version 3.4.2, which contains the authorization fix per the Apache project's own recommendation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Apache DolphinScheduler instances and identify current versions; determine which systems have versions before 3.4.2. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today