CVE-2026-66083 - Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource

Back Back to CVE browser

MEDIUM

Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource

Published Sep 29, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.23%

Description

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata, depending on the fields returned by the endpoint.

This issue affects Apache DolphinScheduler: before 3.4.3.

Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Affected products

Vendor Apache Software Foundation Product Apache DolphinScheduler Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <3.4.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache DolphinScheduler

unaffected

Version	Status	Constraints
0	affected	<3.4.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-306

Missing Authentication

References (3)

http://www.openwall.com/lists/oss-security/2026/09/29/19
Mailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88742
Advisory
https://lists.apache.org/thread/b6brfom0jmy9kdt40qrn6dq0x4v2wxdr
vendor-advisoryVendor Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2026/09/29/19		Mailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88742		Advisory
https://lists.apache.org/thread/b6brfom0jmy9kdt40qrn6dq0x4v2wxdr		vendor-advisoryVendor Advisory