Apache Software FoundationCVE-2026-66083
Apache DolphinScheduler: missing authentication
Medium6.5CVE-2026-66083 · Published Sep 29, 2026
The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata, depending on the fields returned by the endpoint. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Apache DolphinScheduler Product | < 3.4.3 | 3.4.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- CISA (its enrichment of the CVE record)
- Weakness
- CWE-306
More Apache Software Foundation advisories
All Apache Software Foundation| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 29 | Apache Polaris: missing authorization | High8.1 | 1.8.0 |
| Sep 29 | Apache DolphinScheduler: improper authorization | Medium4.3 | 3.4.3 |
| Sep 29 | Apache DolphinScheduler: missing authorization | Medium6.5 | 3.4.3 |
| Sep 29 | Apache DolphinScheduler: authentication bypass | Medium5.3 | 3.4.3 |
| Sep 29 | Apache DolphinScheduler: improper authorization | Medium4.3 | 3.4.3 |
| Sep 29 | Apache DolphinScheduler: improper authorization | Medium4.3 | 3.4.3 |