CVE-2026-71183

HighCVSS 7.1/10Last modified Oct 8, 2026

Description

An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints.

These endpoints fail to enforce the required data source access controls and return sensitive connection information, including data source passwords. As a result, an authenticated user without permission to access a data source can retrieve its connection details and credentials.

Successful exploitation exposes sensitive data source information and may enable unauthorized access to the underlying databases using the disclosed credentials.

This issue affects Apache DolphinScheduler: before 3.4.3.

Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Oct 8, 2026
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-711848.8Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does nCVE-2026-711879.8The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate validCVE-2026-711893.5An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execCVE-2026-71198.8A vulnerability was detected in Tenda HG3 2.0. The impacted element is an unknown function of the file /boaform/formCountrystr. The manipulaCVE-2026-711908.7In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtrackiCVE-2026-711916.0In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the SigV4 signature on preCVE-2026-711926.0In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-Copy-From-Account) frCVE-2026-711939.6In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to CVE-2026-711946.8In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When tCVE-2026-711959.9In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API conCVE-2026-711987.0In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike theCVE-2026-71205.3@fastify/static evaluates the allowedPath callback before normalizing dot segments and duplicate path separators in the pathname used for fi