CVE-2026-66083: Apache DolphinScheduler Info Disclosure Bug

CVE-2026-66083 Overview

CVE-2026-66083 is a broken access control vulnerability in Apache DolphinScheduler affecting versions before 3.4.3. The /datasources/unauth-datasource endpoint fails to enforce data source authorization checks. Any authenticated user can invoke this endpoint to enumerate data sources they should not have access to. The response may expose data source configuration and other sensitive metadata, depending on the fields returned. The Apache DolphinScheduler project has released version 3.4.3 to remediate the issue.

Critical Impact
Authenticated users can retrieve configuration and metadata for data sources belonging to other tenants or users, leading to information disclosure across workflow environments.

Affected Products

Apache DolphinScheduler versions prior to 3.4.3
Deployments exposing the /datasources/unauth-datasource REST endpoint
Multi-tenant DolphinScheduler installations with shared authenticated user populations

Discovery Timeline

2026-09-29 - CVE CVE-2026-66083 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-66083

Vulnerability Analysis

Apache DolphinScheduler exposes a REST endpoint at /datasources/unauth-datasource intended to return data source references. The endpoint performs authentication checks but omits per-object authorization. An authenticated user with any valid session token can query the endpoint and receive data source objects owned by other users or projects. Returned fields may include connection parameters, host references, and configuration metadata. This maps to [CWE-306] Missing Authentication for a Critical Function, applied at the authorization layer.

Root Cause

The root cause is missing access-control enforcement in the endpoint handler. The controller resolves data source records without validating whether the requesting principal is bound to the owning project or tenant. Authorization filtering is expected at the service layer but is not applied in this code path. Version 3.4.3 introduces the missing authorization check.

Attack Vector

An attacker requires valid credentials to any DolphinScheduler account. From an authenticated session, the attacker issues HTTP requests to the vulnerable endpoint. No user interaction is needed. The attacker can iterate over identifiers to enumerate data sources across the deployment. Refer to the Apache Security Mailing List Thread and the OpenWall OSS Security Update for advisory details.

No public proof-of-concept exploit code has been released for this issue. The vulnerability mechanism is straightforward HTTP invocation of an authenticated endpoint that returns unauthorized data.

Detection Methods for CVE-2026-66083

Indicators of Compromise

HTTP requests to /datasources/unauth-datasource from user accounts that do not own the referenced data sources
High-frequency or sequential requests to the endpoint suggesting enumeration behavior
Application logs showing successful responses to the endpoint for users outside expected project scopes

Detection Strategies

Enable and review DolphinScheduler API access logs for calls to /datasources/unauth-datasource
Correlate authenticated session identity with the data source IDs returned in responses to identify cross-tenant access
Deploy a WAF or reverse-proxy rule to alert on any invocation of the endpoint until version 3.4.3 is deployed

Monitoring Recommendations

Ingest DolphinScheduler application and access logs into a centralized analytics platform for behavioral baselining
Alert on burst patterns of endpoint calls from a single account within short time windows
Track privileged data source metadata reads and reconcile them against role assignments

How to Mitigate CVE-2026-66083

Immediate Actions Required

Upgrade Apache DolphinScheduler to version 3.4.3 or later on all nodes
Rotate credentials and secrets stored in data source configurations that may have been exposed
Audit account inventory and disable unused or stale user accounts that reduce the attack surface

Patch Information

Apache has released version 3.4.3 which enforces authorization on the /datasources/unauth-datasource endpoint. Administrators should upgrade all DolphinScheduler master, worker, and API server components. Consult the Apache Security Mailing List Thread for the official advisory and release notes.

Workarounds

Restrict network access to the DolphinScheduler API layer using ingress controls or IP allowlists
Block requests to /datasources/unauth-datasource at a reverse proxy or WAF until the upgrade is applied
Enforce least-privilege role assignments and remove authenticated accounts that do not require data source visibility

bash

# Example NGINX reverse-proxy rule to block the vulnerable endpoint
location ~* ^/datasources/unauth-datasource {
    deny all;
    return 403;
}