CVE-2026-71183 Overview
CVE-2026-71183 is an authorization vulnerability in Apache DolphinScheduler that exposes data source connection details, including passwords, to authenticated users without proper access rights. The flaw resides in the /unauth-datasource and /authed-datasource endpoints, which fail to enforce data source access controls. Any authenticated user can enumerate data sources and retrieve credentials belonging to other users or projects. The disclosed credentials can then be used to connect directly to the underlying databases, extending the impact beyond DolphinScheduler itself. The issue is categorized under [CWE-863: Incorrect Authorization] and affects all Apache DolphinScheduler versions prior to 3.4.3.
Critical Impact
Authenticated users can retrieve plaintext data source passwords and gain unauthorized access to backend databases connected to DolphinScheduler.
Affected Products
- Apache DolphinScheduler versions before 3.4.3
- Deployments exposing the /unauth-datasource REST endpoint
- Deployments exposing the /authed-datasource REST endpoint
Discovery Timeline
- 2026-10-08 - CVE CVE-2026-71183 published to NVD
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2026-71183
Vulnerability Analysis
Apache DolphinScheduler is a distributed workflow scheduling platform used to orchestrate data pipelines. The platform manages data source definitions, which hold connection URLs, usernames, and passwords for databases such as MySQL, PostgreSQL, and Hive. These credentials are considered sensitive because they grant direct access to backend systems.
The /unauth-datasource and /authed-datasource endpoints are intended to list data sources available to a user. However, both endpoints return full connection records, including password fields, without validating whether the requesting user has permission to view each specific data source. An authenticated user with any role can call these endpoints and receive every data source definition registered in the system.
The root issue is a broken object-level authorization check. The API returns connection metadata that should be filtered by ownership or project membership, but the server-side authorization layer never evaluates these conditions before serialization.
Root Cause
The vulnerability stems from missing authorization enforcement at the controller layer for data source listing endpoints [CWE-863]. The endpoints trust that an authenticated session is sufficient to receive full data source objects, including the password field. No per-record access control decision is applied prior to returning the response, and no field-level redaction removes credential material from the serialized output.
Attack Vector
An attacker needs valid DolphinScheduler credentials with any privilege level. The attacker sends an HTTP request to /unauth-datasource or /authed-datasource and parses the JSON response to extract connection strings and passwords. The attacker then connects directly to the exposed databases using the harvested credentials. Exploitation requires network access to the DolphinScheduler API and does not require user interaction.
No public proof-of-concept exploit code is available at the time of publication. Technical details are described in the Apache Mailing List Thread and the Openwall OSS-Security Update.
Detection Methods for CVE-2026-71183
Indicators of Compromise
- Unexpected HTTP GET requests to /unauth-datasource or /authed-datasource from low-privilege user sessions.
- Database authentication events originating from workstations or hosts that do not normally access DolphinScheduler-managed databases.
- Spikes in data source enumeration activity in DolphinScheduler access logs tied to a single user identity.
Detection Strategies
- Review DolphinScheduler API gateway and application logs for repeated calls to the affected endpoints by non-administrative accounts.
- Correlate DolphinScheduler user activity with backend database authentication logs to identify credential reuse outside of scheduled workflows.
- Alert on database logins from service accounts that occur outside of expected scheduler execution windows.
Monitoring Recommendations
- Enable verbose request logging on the DolphinScheduler API server and forward logs to a centralized analytics platform.
- Monitor for anomalous read volumes from the data source management APIs and establish per-user baselines.
- Track database credential usage patterns and alert when connections originate from unexpected source IPs or user agents.
How to Mitigate CVE-2026-71183
Immediate Actions Required
- Upgrade Apache DolphinScheduler to version 3.4.3, which enforces authorization on the affected endpoints.
- Rotate all data source passwords stored in DolphinScheduler, assuming credentials may have been exposed prior to patching.
- Audit DolphinScheduler user accounts and remove inactive or unnecessary low-privilege users that could be leveraged for exploitation.
- Review backend database access logs for unauthorized authentications since the vulnerability became exploitable.
Patch Information
Apache DolphinScheduler version 3.4.3 fixes the authorization flaw by enforcing proper access controls on the /unauth-datasource and /authed-datasource endpoints. Users should upgrade immediately. See the Apache Mailing List Thread for the official announcement.
Workarounds
- Restrict network access to the DolphinScheduler API using firewall rules or a reverse proxy that limits access to trusted administrators until the upgrade is applied.
- Block requests to /unauth-datasource and /authed-datasource at the ingress layer for non-administrative users.
- Reduce the number of accounts with authenticated access to DolphinScheduler to limit exposure during the mitigation window.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
