Apache DolphinScheduler vulnerable to sensitive information disclosure
High7.5CVE-2025-62188 · Published Apr 9, 2026 · updated Apr 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.dolphinscheduler:dolphinscheduler Maven | >= 3.1.0, < 3.2.0 | 3.2.0 |
Details and references
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler. This vulnerability may allow unauthorized actors to access sensitive information, including database credentials. This issue affects Apache DolphinScheduler versions 3.1.*. Users are recommended to upgrade to: * version ≥ 3.2.0 if using 3.1.x As a temporary workaround, users who cannot upgrade immediately may restrict the exposed management endpoints by setting the following environment variable: ``` MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus ``` Alternatively, add the following configuration to the application.yaml file: ``` management: endpoints: web: exposure: include: health,metrics,prometheus ``` This issue has been reported as CVE-2023-48796: https://cveprocess.apache.org/cve5/CVE-2023-48796
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- CVE-2025-62188
More dolphinscheduler advisories
All| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Apr 24 | Apache DolphinScheduler has an Incorrect Authorization Vulnerability CVE-2026-23902High8.1fixed in 3.4.1 | High8.1 | 3.4.1 |
| Apr 24 | Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerability CVE-2025-62233Medium6.3fixed in 3.3.1 | Medium6.3 | 3.3.1 |
| Sep 92025 | Apache DolphinScheduler vulnerable to Alert Script Attack CVE-2024-43115High8.8fixed in 3.2.2 | High8.8 | 3.2.2 |
| Sep 32025 | Apache DolphinScheduler Incorrect Default Permissions Vulnerability CVE-2024-43166Lowfixed in 3.3.1 | Low | 3.3.1 |
| Aug 122024 | Apache DolphinScheduler: Resource File Read And Write Vulnerability CVE-2024-30188High8.1fixed in 3.2.2 | High8.1 | 3.2.2 |
| Aug 122024 | Apache DolphinScheduler: RCE by arbitrary js execution CVE-2024-29831High8.8fixed in 3.2.2 | High8.8 | 3.2.2 |