CVE-2026-71895 Overview
CVE-2026-71895 is a missing authorization vulnerability [CWE-862] in Apache DolphinScheduler. Authenticated non-admin users can retrieve Kubernetes configuration data that should remain restricted to administrators. The exposed kubeconfig contains credentials that permit direct authentication to the Kubernetes API outside of DolphinScheduler.
The flaw affects Apache DolphinScheduler versions 3.2.0 through versions before 3.4.3. Users should upgrade to version 3.4.3 to remediate the issue.
Critical Impact
If the leaked kubeconfig grants cluster-admin or broad service-account privileges, attackers can read Kubernetes Secrets, create pods, and establish persistent access to the cluster.
Affected Products
- Apache DolphinScheduler 3.2.0 through 3.2.x
- Apache DolphinScheduler 3.3.0 through 3.3.x
- Apache DolphinScheduler 3.4.0 through versions before 3.4.3
Discovery Timeline
- 2026-10-08 - CVE CVE-2026-71895 published to NVD
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2026-71895
Vulnerability Analysis
Apache DolphinScheduler is a distributed workflow scheduling platform that supports Kubernetes as an execution backend. Administrators configure cluster endpoints by uploading kubeconfig content so DolphinScheduler can submit workloads to Kubernetes.
The vulnerability allows any authenticated non-admin user to request this administrator-scoped Kubernetes configuration through the application. Because kubeconfig files embed service-account tokens or client certificates, disclosure effectively hands cluster credentials to any logged-in user.
Once an attacker extracts the kubeconfig, authentication to the Kubernetes API server no longer requires the DolphinScheduler application. The attacker interacts directly with the cluster using standard tools such as kubectl, bypassing DolphinScheduler's own role model entirely.
Root Cause
The root cause is a missing authorization check [CWE-862] on the endpoint that returns Kubernetes cluster configuration. The server returns kubeconfig content without verifying that the requesting user holds the administrator role required to view cluster-management data.
Attack Vector
Exploitation requires network access to a DolphinScheduler instance and a valid low-privilege account. The attacker authenticates to the web interface or API, invokes the cluster-configuration retrieval function, and captures the returned kubeconfig data. The attacker then loads the configuration into any Kubernetes client and issues API calls with the embedded credentials. Impact scales with the privileges bound to the service account referenced in the leaked file. Refer to the Apache Thread Discussion and OpenWall OSS Security Update for additional detail.
Detection Methods for CVE-2026-71895
Indicators of Compromise
- Non-administrator user sessions in DolphinScheduler accessing cluster-management endpoints or exporting Kubernetes configuration.
- Kubernetes API audit entries showing authentication from client IP addresses or user agents that do not match the DolphinScheduler worker nodes.
- Unexpected pod creation, Secret enumeration, or exec activity performed with the DolphinScheduler service account outside normal workflow execution windows.
Detection Strategies
- Review DolphinScheduler application logs for requests to cluster or kubeconfig retrieval endpoints and correlate with user role assignments.
- Enable Kubernetes API server audit logging and alert on kubeconfig-bound service accounts invoked from untrusted source IPs.
- Hunt for kubectl command patterns or REST calls to /api/v1/secrets and /api/v1/pods originating from identities tied to DolphinScheduler.
Monitoring Recommendations
- Monitor privileged role changes and new user registrations in DolphinScheduler for anomalous activity preceding cluster-config access.
- Track outbound traffic from the DolphinScheduler host to confirm Kubernetes API traffic originates only from expected service components.
- Baseline the volume and timing of Kubernetes API calls per service account and alert on deviations.
How to Mitigate CVE-2026-71895
Immediate Actions Required
- Upgrade all Apache DolphinScheduler deployments in the 3.2.0 to 3.4.2 range to version 3.4.3.
- Rotate every kubeconfig, service-account token, and client certificate previously stored in affected DolphinScheduler instances.
- Review Kubernetes RBAC bindings for service accounts referenced by DolphinScheduler and apply least-privilege scopes.
Patch Information
Apache released a fix in Apache DolphinScheduler 3.4.3. The update adds the missing authorization check so that only administrators can retrieve Kubernetes cluster configuration. Deployment details are available in the Apache Thread Discussion and the OpenWall OSS Security Update.
Workarounds
- Restrict DolphinScheduler account creation and audit existing non-admin accounts until the upgrade completes.
- Place DolphinScheduler behind network controls that limit access to trusted operator networks only.
- Replace broadly privileged kubeconfigs with narrowly scoped service accounts limited to the namespaces DolphinScheduler requires.
# Configuration example
# Verify the installed DolphinScheduler version
curl -s http://dolphinscheduler.example.com/dolphinscheduler/actuator/info | jq .
# Create a least-privilege ServiceAccount for DolphinScheduler
kubectl create serviceaccount dolphinscheduler-runner -n dolphin-ns
kubectl create rolebinding dolphin-runner-binding \
--role=pod-runner \
--serviceaccount=dolphin-ns:dolphinscheduler-runner \
-n dolphin-ns
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
