CVE-2026-66083CWE-306

CVE-2026-66083

Medium · published September 29, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
22.1
In the wild
Unconfirmed
What it is

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata, depending on the fields returned by the endpoint.

This issue affects Apache DolphinScheduler: before 3.4.3.

Users are recommended to upgrade to version 3.4.3, which fixes the issue.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00305 · 22.1th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-29T16:17Z
Affected products (1)
ProductVersionsFixed in
apache/dolphinscheduler< 3.4.33.4.3
References (2)
https://lists.apache.org/thread/b6brfom0jmy9kdt40qrn6dq0x4v2wxdr · [email protected]http://www.openwall.com/lists/oss-security/2026/09/29/19 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 01 OCT 03:48Z
    EPSS moved — → 0%
    epss
  • 29 SEP 11:46Z
    Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource
    cvelistv5