Apache DolphinScheduler’s RPC module accepts serialized objects from clients. Attackers who can reach the Master or Worker nodes can craft a StandardRpcRequest, inject a malicious class type, and transmit it to the server. The deserialization of this untrusted data allows an attacker to execute arbitrary code on the nodes, potentially compromising the entire scheduling infrastructure. This flaw is classed as CWE‑502 Improper Handling of Serialized Data.

The vulnerability affects Apache DolphinScheduler versions 3.2.0 through 3.3.0 inclusive. It targets the Apache Software Foundation’s DolphinScheduler product, which is distributed under the Apache license. All installations running a vulnerable version are at risk unless patched or otherwise mitigated.

The CVSS score is 6.3, indicating moderate severity, while the EPSS score is below 1 %, suggesting a low probability of exploitation in the wild at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers must be able to send RPC requests to the Master or Worker nodes, so the primary attack vector is internal or privileged network access to the RPC service. With the current scores, the risk is moderate, but the potential impact warrants timely remediation.