Description
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler.

This vulnerability may allow unauthorized actors to access sensitive information, including database credentials.


This issue affects Apache DolphinScheduler versions 3.1.*.


Users are recommended to upgrade to:







* version ≥ 3.2.0 if using 3.1.x






As a temporary workaround, users who cannot upgrade immediately may restrict the exposed management endpoints by setting the following environment variable:


```
MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus
```

Alternatively, add the following configuration to the application.yaml file:


```
management:
   endpoints:
     web:
        exposure:
          include: health,metrics,prometheus
```

This issue has been reported as CVE-2023-48796:

https://cveprocess.apache.org/cve5/CVE-2023-48796
Published: 2026-04-09
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Information Disclosure
Action: Immediate Patch
AI Analysis

Impact

Unauthorized actors can retrieve sensitive data, such as database credentials, by accessing the actuator endpoint of Apache DolphinScheduler. The weakness is a confidential data exposure (CWE‑200) resulting in a breach of confidentiality for the system and potentially linked services.

Affected Systems

Apache DolphinScheduler produced by the Apache Software Foundation is affected. All releases in the 3.1.x series are vulnerable. Users should upgrade to version 3.2.0 or later to eliminate the exposure.

Risk and Exploitability

The CVSS score of 7.5 indicates moderate to high severity, while the EPSS score below 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote network access to the exposed actuator endpoint, which lacks authentication checks. No additional prerequisites beyond reaching the endpoint are stated in the available information.

Generated by OpenCVE AI on April 9, 2026 at 15:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor upgrade to Apache DolphinScheduler version 3.2.0 or later
  • As a temporary workaround, restrict the exposed management endpoints by setting the environment variable MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus or by adding the following to application.yaml: management: endpoints: web: exposure: include: health,metrics,prometheus

Generated by OpenCVE AI on April 9, 2026 at 15:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-3cjc-vhfm-ffp2 Apache DolphinScheduler vulnerable to sensitive information disclosure
History

Fri, 17 Apr 2026 13:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*

Fri, 10 Apr 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache dolphinscheduler
Vendors & Products Apache
Apache dolphinscheduler

Thu, 09 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 09 Apr 2026 10:00:00 +0000

Type Values Removed Values Added
Description An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler. This vulnerability may allow unauthorized actors to access sensitive information, including database credentials. This issue affects Apache DolphinScheduler versions 3.1.*. Users are recommended to upgrade to: * version ≥ 3.2.0 if using 3.1.x As a temporary workaround, users who cannot upgrade immediately may restrict the exposed management endpoints by setting the following environment variable: ``` MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus ``` Alternatively, add the following configuration to the application.yaml file: ``` management:    endpoints:      web:         exposure:           include: health,metrics,prometheus ``` This issue has been reported as CVE-2023-48796: https://cveprocess.apache.org/cve5/CVE-2023-48796
Title Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.
Weaknesses CWE-200
References

Subscriptions

Apache Dolphinscheduler
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-04-09T13:57:33.406Z

Reserved: 2025-10-08T15:40:33.512Z

Link: CVE-2025-62188

cve-icon Vulnrichment

Updated: 2026-04-09T13:56:10.730Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-09T10:16:20.260

Modified: 2026-04-17T12:57:33.973

Link: CVE-2025-62188

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-10T09:33:00Z

Weaknesses