CVE-2026-71895

HighCVSS 7.1/10Last modified Oct 8, 2026

Description

An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the Kubernetes API outside DolphinScheduler.

The impact depends on the permissions granted to the disclosed credentials. If the kubeconfig provides cluster-admin or broadly privileged service-account access, an attacker may read Kubernetes Secrets, create pods, and establish persistent access to the cluster.

This issue affects Apache DolphinScheduler: from 3.2.0 before 3.4.3.

Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 8, 2026
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-718966.5An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through th CVE-2026-718974.3An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to op CVE-2026-718984.3An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a CVE-2026-718996.5A missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler. The API does not properly CVE-2026-719047.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by in CVE-2026-719057.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by ins CVE-2026-719067.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficien CVE-2026-719077.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insuffic CVE-2026-719087.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused CVE-2026-719097.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insuff CVE-2026-71917.2Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated CVE-2026-719107.2Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insuffi