CVE-2026-71895 Details
Description
An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the Kubernetes API outside DolphinScheduler. The impact depends on the permissions granted to the disclosed credentials. If the kubeconfig provides cluster-admin or broadly privileged service-account access, an attacker may read Kubernetes Secrets, create pods, and establish persistent access to the cluster. This issue affects Apache DolphinScheduler: from 3.2.0 before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.
An authorization vulnerability exists in Apache DolphinScheduler versions 3.2.0 prior to 3.4.3, allowing authenticated non-admin users to access Kubernetes configuration data meant for administrators. This exposed kubeconfig information includes credentials that could enable authentication to the Kubernetes API outside of DolphinScheduler. The severity of the impact varies based on the permissions associated with the leaked credentials. If the kubeconfig grants cluster-admin or broadly privileged service-account access, it could allow an attacker to read Kubernetes Secrets, create pods, and maintain persistent access to the cluster.
Users are advised to upgrade to Apache DolphinScheduler version 3.4.3, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/10/08/5 | CVE | AdvisoryMailing ListRemedy |
| https://lists.apache.org/thread.html/8g6p34cf0m7fnox5qpm99r50g8rbt0fp | [email protected] | AdvisoryMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Apache DolphinScheduler | >= 3.2.0, < 3.4.3 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 8, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | CVE Modified | CVE |
| Oct 8, 2026 | New CVE Received | [email protected] |