CVE-2026-82804 Apache DolphinScheduler: Command Injection in the Alert Script Plugin
An authenticated user can execute arbitrary commands via shell metacharacters in resource filenames used by the Alert Script plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82804?
CVE-2026-82804 is a high-severity command injection vulnerability in Apache DolphinScheduler, published on 29 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution.
An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitution syntax, such as $(...), and subsequently supplying the resulting path to the Alert Script plugin's /test-send endpoint. When the alert script is executed, the shell interprets the injected command, resulting in arbitrary command execution with the privileges of the DolphinScheduler service process.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
Weakness: CWE-78
Which versions are affected by CVE-2026-82804?
How do I fix CVE-2026-82804?
No fix has been published for CVE-2026-82804 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-82804 being exploited?
There is no known exploitation of CVE-2026-82804 in the wild and no public exploit code.
Sources
Also known as GHSA-6m78-8x87-73vx.