Apache DolphinScheduler: exposed management endpoints leak database credentials to unauthenticated callers

Impact

DolphinScheduler 3.1.x leaves its Spring Boot management endpoints broadly exposed, so an unauthenticated caller who can reach the service reads back sensitive configuration including database credentials. Where DolphinScheduler drives data and training pipelines on a fleet, its metadata database holds the pipeline definitions and connection details for everything it orchestrates - the credentials recovered this way typically open object storage, warehouses and job submission paths well beyond the scheduler itself. Impact is confidentiality only; nothing here grants code execution directly. NVD notes this is the same issue previously tracked as CVE-2023-48796.

Who can reach it

Anyone who can reach the DolphinScheduler API/management port. No authentication required. Not exploitable if the service is bound to a trusted network only - but the endpoints are open to anyone who gets that far.

What to do

Upgrade to 3.2.0 or later. If an upgrade window is not available, restrict the exposed endpoints with MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus or the equivalent management.endpoints.web.exposure.include block in application.yaml, which the Apache advisory gives as the temporary workaround. Either path is a service restart of the DolphinScheduler components, not a node action; running jobs are affected only as far as a scheduler restart affects them. Rotate any database credentials that were readable while the endpoints were exposed.

References

Related entries

• Jenkins SAML Plugin: no replay cache lets a captured SAML response be reused to log in as that userCVE-2025-64131 · Jenkins SAML Plugin (SAML response replay cache)High
• Apache Airflow: pre-3.2 deployments lack the isolation guarantees operators assumed, per clarified security modelCVE-2025-66236 · Apache Airflow (workload isolation and JWT token authentication, deployments before 3.2.0)High
• Apache Airflow: oversized rendered template fields bypass user-registered secret masksCVE-2025-68438 · Apache Airflow (Rendered Templates UI, secrets masker)High
• Apache Airflow: proxy URLs with embedded credentials are not masked in task logsCVE-2025-68675 · Apache Airflow (Connection proxy fields, log masking)High
• GitLab CE/EE: unauthenticated poisoning of the cached OIDC discovery document redirects auth flowsCVE-2026-112212 · GitLab CE/EE (cached OAuth/OIDC discovery document)High
• GitLab EE: unauthenticated crafted file upload can deny service to the instanceCVE-2026-1184 · GitLab EE (file upload handling)High