An authorization flaw in Apache DolphinScheduler allows authenticated users who are not administrators to retrieve Kubernetes kubeconfig files that the system uses to manage the cluster. The kubeconfig contains credentials that the attacker can use to authenticate directly to the Kubernetes API. If those credentials have cluster‑admin or a broad service‑account scope, the attacker can read secrets, launch pods, or otherwise gain persistent control of the cluster.

Apache DolphinScheduler versions 3.2.0 through 3.4.2 are vulnerable. Any installation running these versions that permits non‑admin users to access the DolphinScheduler API or UI is at risk.

The likely attack vector is through the DolphinScheduler credential endpoint or API calls that expose the kubeconfig file. Based on the description, it is inferred that authenticated non‑admin users can retrieve the kubeconfig data and then use the embedded credentials to authenticate directly to the Kubernetes API. Once acquired, the credentials may allow the attacker to read secrets, create pods, or maintain persistent access if they have cluster‑admin or high‑privilege service‑account scope. The CVSS score of 7.1 indicates moderate severity, and protection against this flaw is critical for installations where the kubeconfig grants elevated privileges. EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, so exploitation frequency remains uncertain.