[ CVE-2026-66083 · Published 29 Sep 2026 ]

Vulnerability in Apache Software Foundation Apache DolphinScheduler

CVSS 6.5 EPSS <1%No fix listed yet

[ Description ]Official description

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata, depending on the fields returned by the endpoint. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

lists.apache.org/thread/b6brfom0jmy9kdt40qrn6dq0x4v2wxdrVendor Advisory
www.openwall.com/lists/oss-security/2026/09/29/19Mailing ListThird Party Advisory