CVE-2026-66083 in DolphinScheduler
Summary
by MITRE • 09/29/2026
The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata, depending on the fields returned by the endpoint.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in Apache DolphinScheduler prior to version 3.4.3 represents a critical failure in access control mechanisms within the application's data source management subsystem. Specifically, the endpoint /datasources/unauth-datasource fails to properly enforce authorization checks when handling requests from authenticated users. This flaw allows any user who has successfully logged into the system to query metadata and configuration details for data sources that they do not have explicit permission to access or manage. The root cause lies in the server-side logic which validates authentication but neglects to verify whether the requesting principal holds sufficient privileges relative to the specific resource being requested, a classic example of an insecure direct object reference where the system assumes identity implies authorization without verifying scope.
From a technical perspective, this vulnerability enables unauthorized information disclosure by exposing sensitive configuration parameters associated with various data sources. These configurations often include connection strings, hostnames, port numbers, and potentially authentication credentials or API keys required to interact with external databases and services such as MySQL, PostgreSQL, Hive, Spark, or other supported engines within the DolphinScheduler ecosystem. By leveraging this endpoint, an attacker can map out the underlying infrastructure architecture of the target organization. This reconnaissance capability is particularly dangerous because it provides a detailed blueprint of how data flows through the system, revealing which external systems are integrated and their network locations, thereby facilitating further targeted attacks against those downstream services.
The operational impact of this vulnerability extends beyond mere information leakage to potential compromise of broader organizational security posture. Since the exposed metadata may contain credentials or connection details for critical data stores, an attacker could use this information to attempt direct access to these databases if additional layers of network segmentation are absent. Furthermore, knowledge of specific data source configurations can aid in crafting more effective social engineering attacks or identifying version-specific vulnerabilities in third-party software components referenced by the configuration files. In environments where DolphinScheduler is used for orchestrating sensitive ETL processes, this exposure undermines trust and compliance with regulatory standards that mandate strict separation of duties and least-privilege access models.
This issue aligns closely with CWE-284 Improper Access Control, as it involves a failure to restrict information access to authorized actors, and falls under the MITRE ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to move laterally or gather intelligence within a network. The lack of proper authorization checks on an authenticated endpoint highlights a gap in implementing robust role-based access control policies for administrative resources. To mitigate this risk, organizations must upgrade Apache DolphinScheduler to version 3.4.3 or later, which includes the necessary patches to enforce strict authorization checks on all data source endpoints. Additionally, administrators should review existing user roles and permissions to ensure that only authorized personnel have access to sensitive configuration areas, implement network-level restrictions where possible to limit exposure of management interfaces, and conduct regular audits of API endpoint behaviors to detect any deviations from expected security policies.