Is CVE-2025-62188 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-62188 being exploited in the wild.

How severe is CVE-2025-62188?

High severity, with a CVSS score of 7.5, published 9 April 2026.

Which products and versions are affected?

Apache Software Foundation DolphinScheduler >= 3.1.0, = 3.1.0, < 3.2.0, ECOSYSTEM:introduced=3.1.0,fixed=3.2.0.

Is there a fix for CVE-2025-62188?

Yes. org.apache.dolphinscheduler:dolphinscheduler (Maven): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-62188 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-62188?

Check whether you run Apache DolphinScheduler, Apache Software Foundation DolphinScheduler or org.apache.dolphinscheduler:dolphinscheduler (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-62188: Apache DolphinScheduler sensitive information disclosure in management endpoints

Q: Is there a fix for CVE-2025-62188?

Yes. org.apache.dolphinscheduler:dolphinscheduler (Maven): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-62188 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2025-62188?

Check whether you run Apache DolphinScheduler, Apache Software Foundation DolphinScheduler or org.apache.dolphinscheduler:dolphinscheduler (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-62188 · Severity: high · CVSS 7.5 · Published 2026-04-09

Apache DolphinScheduler, a workflow orchestration platform, contains a vulnerability where sensitive management endpoints are exposed to unauthorized users. An attacker could exploit this to access internal system information, including database credentials. This could lead to a full compromise of the data managed by the scheduler or unauthorized access to connected infrastructure.

Technologies: Apache DolphinScheduler, Apache Software Foundation DolphinScheduler, org.apache.dolphinscheduler:dolphinscheduler (Maven). Vendors: Apache, Apache Software Foundation, Maven.

Quick answers

Is CVE-2025-62188 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-62188 being exploited in the wild.
How severe is CVE-2025-62188?: High severity, with a CVSS score of 7.5, published 9 April 2026.
Which products and versions are affected?: Apache Software Foundation DolphinScheduler >= 3.1.0, < 3.2.0; org.apache.dolphinscheduler:dolphinscheduler (Maven) >= 3.1.0, < 3.2.0, ECOSYSTEM:introduced=3.1.0,fixed=3.2.0.
Is there a fix for CVE-2025-62188?: Yes. org.apache.dolphinscheduler:dolphinscheduler (Maven): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-62188 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-62188?: Check whether you run Apache DolphinScheduler, Apache Software Foundation DolphinScheduler or org.apache.dolphinscheduler:dolphinscheduler (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.dolphinscheduler:dolphinscheduler (Maven): upgrade to 3.2.0 or later

# set org.apache.dolphinscheduler:dolphinscheduler to 3.2.0 in your pom.xml or build.gradle

Technical details

An information disclosure vulnerability (CWE-200) exists in Apache DolphinScheduler versions 3.1.0 through 3.1.x due to the improper exposure of Actuator/management endpoints. A remote, unauthenticated attacker can access these endpoints over the network to retrieve sensitive configuration details, including database credentials. The issue is resolved in version 3.2.0 by restricting the default set of exposed endpoints. A workaround is available by manually configuring 'management.endpoints.web.exposure.include' to only include 'health,metrics,prometheus' in the application configuration.

Affected products

Apache DolphinScheduler >= 3.1.0, < 3.2.0

Identifiers

CVE-2025-62188
GHSA-3cjc-vhfm-ffp2

Timeline

2026-04-09: advisory: GitHub Advisory and NVD entry published
2026-04-10: patched: Advisory reviewed and updated with patch information

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.