AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

dolphinschedulerGHSA-rrpj-r8h7-rm7r

Apache DolphinScheduler Incorrect Default Permissions Vulnerability

dolphinscheduler

CVE-2024-43166 · Published Sep 3, 2025

Low
Fix: upgrade to 3.3.1 or later
GitHub advisory

Incorrect Default Permissions vulnerability in Apache DolphinScheduler.

This issue affects Apache DolphinScheduler: before 3.2.2.

Users are recommended to upgrade to version 3.3.1, which fixes the issue.

Affected versions

PackageAffectedFixed in
org.apache.dolphinscheduler:dolphinscheduler
Maven
< 3.3.13.3.1
Details and references
Severity from
GitHub (reviewed advisory)
Weakness
CWE-276
Also known as
CVE-2024-43166

More dolphinscheduler advisories

All dolphinscheduler
Medium 6.3Apr 24Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerabilityCVE-2025-62233fixed in 3.3.1High 8.1Apr 24Apache DolphinScheduler has an Incorrect Authorization VulnerabilityCVE-2026-23902fixed in 3.4.1High 7.5Apr 9Apache DolphinScheduler vulnerable to sensitive information disclosureCVE-2025-62188fixed in 3.2.0High 8.8Sep 9, 2025Apache DolphinScheduler vulnerable to Alert Script AttackCVE-2024-43115fixed in 3.2.2High 8.1Aug 12, 2024Apache DolphinScheduler: Resource File Read And Write VulnerabilityCVE-2024-30188fixed in 3.2.2High 8.8Aug 12, 2024Apache DolphinScheduler: RCE by arbitrary js executionCVE-2024-29831fixed in 3.2.2