Advisoriesby IbisdolphinschedulerGHSA-f786-9c63-8xr8
Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerability
Fix: upgrade to 3.3.1 or later
Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module.
This issue affects Apache DolphinScheduler:
Version >= 3.2.0 and < 3.3.1.
Attackers who can access the Master or Worker nodes can compromise the system by creating a StandardRpcRequest, injecting a malicious class type into it, and sending RPC requests to the DolphinScheduler Master/Worker nodes.
Users are recommended to upgrade to version [3.3.1], which fixes the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.dolphinscheduler:dolphinscheduler Maven | >= 3.2.0, < 3.3.1 | 3.3.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-502
- Also known as
- CVE-2025-62233
More dolphinscheduler advisories
All dolphinscheduler
Apache DolphinScheduler has an Incorrect Authorization VulnerabilityCVE-2026-23902fixed in 3.4.1Apache DolphinScheduler vulnerable to sensitive information disclosureCVE-2025-62188fixed in 3.2.0Apache DolphinScheduler vulnerable to Alert Script AttackCVE-2024-43115fixed in 3.2.2Apache DolphinScheduler Incorrect Default Permissions VulnerabilityCVE-2024-43166fixed in 3.3.1Apache DolphinScheduler: Resource File Read And Write VulnerabilityCVE-2024-30188fixed in 3.2.2Apache DolphinScheduler: RCE by arbitrary js executionCVE-2024-29831fixed in 3.2.2