Apache DolphinScheduler sensitive information disclosure
High7.5CVE-2023-48796 · Published Nov 24, 2023 · updated Dec 1, 2025
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file ``` management: endpoints: web: exposure: include: health,metrics,prometheus ``` This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.dolphinscheduler:dolphinscheduler Maven | >= 3.0.0, < 3.0.2 | 3.0.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- CVE-2023-48796, PYSEC-2023-268
- nvd.nist.gov/vuln/detail/CVE-2023-48796
- github.com/apache/dolphinscheduler
- github.com/pypa/advisory-database/tree/main/vulns/apache-dolphinscheduler/PYSEC-2023-268.yaml
- lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo
- www.openwall.com/lists/oss-security/2023/11/24/1
- www.openwall.com/lists/oss-security/2025/11/28/1
More dolphinscheduler advisories
All dolphinscheduler| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 122024 | Apache DolphinScheduler: RCE by arbitrary js execution High8.8Aug 12, 2024 | High8.8 | 3.2.2 |
| Aug 122024 | Apache DolphinScheduler: Resource File Read And Write VulnerabilityHigh8.1Aug 12, 2024 | High8.1 | 3.2.2 |
| Feb 202024 | Session Fixation Apache DolphinSchedulerMediumFeb 20, 2024 | Medium | 3.2.1 |
| Feb 202024 | Arbitrary File Read Vulnerability in Apache DolphinschedulerHigh7.5Feb 20, 2024 | High7.5 | 3.2.1 |
| Feb 202024 | Improper Certificate Validation in Apache DolphinSchedulerHigh7.3Feb 20, 2024 | High7.3 | 3.2.1 |
| Feb 202024 | Remote Code Execution in Apache DolphinschedulerCritical9.8Feb 20, 2024 | Critical9.8 | 3.2.1 |