CVE-2026-82804 Overview
CVE-2026-82804 is a command injection vulnerability in Apache DolphinScheduler affecting versions before 3.4.3. The flaw resides in the Alert Script plugin, where the scriptPath parameter is passed into a /bin/sh -c command without neutralizing shell metacharacters. Authenticated users can craft a resource filename containing shell command substitution syntax such as $(...) and submit it to the /test-send endpoint. When the alert script executes, the shell interprets the injected payload and runs arbitrary commands with the privileges of the DolphinScheduler service process. The issue is tracked under [CWE-78] (OS Command Injection).
Critical Impact
Authenticated attackers can achieve remote command execution on DolphinScheduler hosts, compromising confidentiality, integrity, and availability of scheduled workflows and connected data systems.
Affected Products
- Apache DolphinScheduler versions prior to 3.4.3
- Deployments exposing the Alert Script plugin /test-send endpoint
- Any workflow environment where authenticated users can create resources
Discovery Timeline
- 2026-09-29 - CVE CVE-2026-82804 published to NVD
- 2026-09-29 - Last updated in NVD database
Technical Details for CVE-2026-82804
Vulnerability Analysis
Apache DolphinScheduler is a distributed workflow orchestration platform. Its Alert Script plugin allows administrators to configure external scripts that fire when alert conditions are triggered. The plugin invokes these scripts through a shell command using /bin/sh -c, concatenating the user-controlled scriptPath value directly into the command line.
Because the parameter is not escaped or validated, any shell metacharacter passes through to the interpreter. An authenticated user with permission to create resources and access the Alert Script test endpoint can turn a routine alert configuration into an arbitrary code execution primitive. The attack requires only low-privileged authentication and no user interaction.
Root Cause
The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The Alert Script plugin builds the shell command via string concatenation rather than passing arguments as a discrete array to execve. Shell substitution sequences such as $(...), backticks, and pipes are interpreted by /bin/sh before the intended script ever runs.
Attack Vector
An authenticated attacker performs the following steps:
- Creates a resource whose filename embeds a shell substitution payload, for example benign_$(id > /tmp/pwn).sh.
- Submits the resulting path as the scriptPath parameter to the Alert Script plugin /test-send endpoint.
- The DolphinScheduler backend invokes /bin/sh -c with the tainted path, executing the injected command under the service account.
The service typically runs with broad access to workflow databases, credentials, and connected data sources, making post-exploitation impact significant.
No verified public proof-of-concept code is available. Refer to the Apache Mailing List Discussion and OpenWall OSS-Security Update for maintainer-provided technical context.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-82804
Indicators of Compromise
- Resource filenames containing shell metacharacters such as $(, backticks, ;, |, or &&.
- Requests to the Alert Script plugin /test-send endpoint with unusual scriptPath values.
- Unexpected child processes spawned by the DolphinScheduler service, particularly sh, curl, wget, bash, or nc.
- Outbound network connections from DolphinScheduler workers to unfamiliar hosts shortly after alert testing.
Detection Strategies
- Inspect DolphinScheduler API access logs for POST requests to /test-send with scriptPath values containing shell substitution syntax.
- Monitor process execution on DolphinScheduler hosts for /bin/sh -c invocations that reference user-controlled paths.
- Correlate resource creation events with subsequent Alert Script test-send calls performed by the same account.
Monitoring Recommendations
- Enable audit logging on the DolphinScheduler API gateway and forward events to a centralized analytics platform.
- Baseline the expected set of alert scripts and alert on deviations in filename patterns.
- Alert on new outbound connections or file writes originating from the DolphinScheduler service user.
How to Mitigate CVE-2026-82804
Immediate Actions Required
- Upgrade Apache DolphinScheduler to version 3.4.3 or later.
- Rotate any credentials, tokens, or database secrets accessible to the DolphinScheduler service if exploitation is suspected.
- Restrict access to the Alert Script plugin and resource management endpoints to trusted administrators only.
Patch Information
Apache has released version 3.4.3, which fixes the command injection by properly handling the scriptPath parameter. Review the Apache Mailing List Discussion for the official maintainer announcement and the OpenWall OSS-Security Update for the coordinated disclosure notice.
Workarounds
- Disable the Alert Script plugin until the upgrade is completed.
- Enforce strict role-based access control so only trusted operators can create resources or invoke /test-send.
- Deploy a reverse proxy rule that rejects requests containing shell metacharacters in scriptPath.
- Run the DolphinScheduler service under a dedicated low-privilege account with restricted file system and network egress permissions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
