CVE-2024-43166CWE-276

Incorrect Default Permissions vulnerability in Apache DolphinScheduler

Critical · published September 3, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
44.2
In the wild
Unconfirmed
What it is

🔥 An incorrect default permissions setting in Apache DolphinScheduler could leave your sensitive data wide open! Think of it like a hotel room with a lock that only works half the time — anyone could walk in without a key! 🏨 If attackers exploit this vulnerability, they could gain unauthorized access to critical resources, putting your entire workflow at risk. Imagine the chaos if someone could just stroll in and change your carefully planned schedules or access confidential information!

Put simply

Think of it like a hotel room with a lock that only works half the time — anyone could walk in without a key! 🏨 This vulnerability arises from Apache DolphinScheduler's flawed handling of default permissions, allowing users to access functions and data they shouldn't even have visibility into.

What to do

If attackers exploit this vulnerability, they could gain unauthorized access to critical resources, putting your entire workflow at risk. Imagine the chaos if someone could just stroll in and change your carefully planned schedules or access confidential information! To protect yourself, upgrade your DolphinScheduler to version 3.3.1 immediately. Review your current permissions settings to ensure everything is configured correctly, and implement a security audit to catch any unintended access points. You’ve got this! Secure your system, and you'll be back on track in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00533 · 44.2th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2025-09-03T09:10Z
EPSS history
Timeline
  • 03 SEP 09:10Z
    Incorrect Default Permissions vulnerability in Apache DolphinScheduler
    cvelistv5