EUVD-2026-94809
GHSA-vpj2-fvw3-8jgc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Authenticated non-admin user (PR:L) over the network (AV:N/AC:L) obtains confidential credentials (C:H); the DolphinScheduler flaw itself is pure disclosure, so I:N/A:N and S:U, with cluster compromise being a conditional downstream effect.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
6Description PRE-NVD
AnalysisAI
Authenticated non-admin users of Apache DolphinScheduler 3.2.0 up to (but not including) 3.4.3 can retrieve the Kubernetes kubeconfig that administrators stored for cluster integration, because the API that serves that data performs no authorization check (CWE-862). With the disclosed kubeconfig an attacker can authenticate directly to the Kubernetes API from outside DolphinScheduler, and the real-world severity is bounded by whatever privileges the embedded service account holds - cluster-admin-grade credentials expose Kubernetes Secrets and allow pod creation and persistence, while narrowly scoped credentials sharply limit what is achievable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated non-admin account on an affected Apache DolphinScheduler instance (3.2.0 per CVE, possibly 3.1.0 per EUVD, up to before 3.4.3) AND an administrator must have configured one or more Kubernetes clusters in DolphinScheduler so that kubeconfig data exists to disclose. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-priority issue with a genuine but conditional impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Apache DolphinScheduler to 3.4.3, which the Apache project states fixes the issue; verify whether your deployment is on 3.1.x or 3.2.x lineage given the conflicting lower bounds in the CVE and EUVD records, and upgrade in either case. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache DolphinScheduler deployments and identify any instance running versions 3.2.0 through 3.4.2 that has Kubernetes cluster integration configured; for those instances, immediately disable or remove the stored kubeconfig integration if operationally feasible, and audit Kubernetes API access logs, service account usage, and Secret access for anomalous activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today