CVE-2026-66083 Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource

Medium 6.5 Published 29 Sep 2026 Updated 29 Sep 2026

An authenticated user can access unauthorized data source information via an unauthenticated endpoint, exposing sensitive configuration metadata.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-66083?

CVE-2026-66083 is a medium-severity missing authorization vulnerability in Apache DolphinScheduler, published on 29 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata, depending on the fields returned by the endpoint.

This issue affects Apache DolphinScheduler: before 3.4.3.

Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Weakness: CWE-306

Which versions are affected by CVE-2026-66083?

It affects 1 product.

Products include Apache Dolphinscheduler.

How do I fix CVE-2026-66083?

No fix has been published for CVE-2026-66083 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-66083 being exploited?

There is no known exploitation of CVE-2026-66083 in the wild and no public exploit code.

Sources

Also known as GHSA-rjm2-8fmf-7h67.