Executive brief
Apache DolphinScheduler, a workflow orchestration platform, contains a vulnerability where sensitive management endpoints are exposed to unauthorized users. An attacker could exploit this to access internal system information, including database credentials. This could lead to a full compromise of the data managed by the scheduler or unauthorized access to connected infrastructure.
Technical details
An information disclosure vulnerability (CWE-200) exists in Apache DolphinScheduler versions 3.1.0 through 3.1.x due to the improper exposure of Actuator/management endpoints. A remote, unauthenticated attacker can access these endpoints over the network to retrieve sensitive configuration details, including database credentials. The issue is resolved in version 3.2.0 by restricting the default set of exposed endpoints. A workaround is available by manually configuring 'management.endpoints.web.exposure.include' to only include 'health,metrics,prometheus' in the application configuration.
Affected products
- Apache DolphinScheduler >= 3.1.0, < 3.2.0
Timeline
- 2026-04-09: advisory: GitHub Advisory and NVD entry published
- 2026-04-10: patched: Advisory reviewed and updated with patch information