CVE-2026-71895 in DolphinScheduler
Summary
by MITRE • 10/08/2026
An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the Kubernetes API outside DolphinScheduler.
The impact depends on the permissions granted to the disclosed credentials. If the kubeconfig provides cluster-admin or broadly privileged service-account access, an attacker may read Kubernetes Secrets, create pods, and establish persistent access to the cluster.
This issue affects Apache DolphinScheduler: from 3.2.0 before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
Apache DolphinScheduler versions prior to 3.4.3 contain a critical authorization vulnerability that allows authenticated non-administrative users to access sensitive Kubernetes configuration data. This flaw stems from an improper restriction of functionality, where the application fails to verify whether the requesting user possesses the necessary administrative privileges before serving kubeconfig files intended for cluster management. The exposed credentials within these configurations can grant direct authentication capabilities to the underlying Kubernetes API, bypassing the security controls enforced by DolphinScheduler itself.
The technical nature of this vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if static keys are involved in the kubeconfig files. From an offensive perspective, this represents a classic case of broken access control where role-based permissions are not strictly enforced at the API level for sensitive resources. An attacker who has obtained valid credentials for DolphinScheduler can exploit this misconfiguration to extract cluster configuration details that were never intended for their user context.
The operational impact is severe and directly dependent on the privileges assigned to the service account embedded in the leaked kubeconfig data. If the compromised credential holds cluster-admin rights or broad permissions, an attacker gains full control over the Kubernetes environment. This includes the ability to read sensitive secrets stored within namespaces, create new pods for arbitrary code execution, and establish persistent backdoors within the infrastructure. Even with lower privileges, access to namespace-specific resources can lead to significant data exfiltration or disruption of services managed by DolphinScheduler.
This vulnerability is categorized under MITRE ATT&CK technique T1078 Valid Accounts, as it relies on legitimate user credentials being misused due to insufficient authorization checks. It also relates to T1528 Steal Application Access Token if the kubeconfig facilitates token theft or direct API access that mimics authorized application behavior. The risk is amplified in environments where DolphinScheduler manages multiple clusters with varying levels of trust and security postures, as a breach in one context could potentially impact others depending on shared credential policies.
To mitigate this vulnerability, organizations must upgrade Apache DolphinScheduler to version 3.4.3 or later, which implements proper access control checks for retrieving Kubernetes configurations. In the interim, administrators should audit user roles within DolphinScheduler to ensure that only designated administrative users have permission to view cluster settings. Additionally, it is advisable to rotate any kubeconfig credentials associated with affected installations and review Kubernetes RBAC policies to minimize the blast radius in case of future exposure. Regular security assessments focusing on authorization logic are recommended to prevent similar access control failures.