https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 22:14:56 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-71183 <p>An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints.</p> <p>These endpoints fail to enforce the required data source access controls and return sensitive connection information, including data source passwords. As a result, an authenticated user without permission to access a data source can retrieve its connection details and credentials.</p> <p>Successful exploitation exposes sensitive data source information and may enable unauthorized access to the underlying databases using the disclosed credentials.</p> <p>This issue affects Apache DolphinScheduler: before 3.4.3.</p> <p>Users are recommended to upgrade to version 3.4.3, which fixes the issue.</p> <p>An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints.</p> <p>These endpoints fail to enforce the required data source access controls and return sensitive connection information, including data source passwords. As a result, an authenticated user without permission to access a data source can retrieve its connection details and credentials.</p> <p>Successful exploitation exposes sensitive data source information and may enable unauthorized access to the underlying databases using the disclosed credentials.</p> <p>This issue affects Apache DolphinScheduler: before 3.4.3.</p> <p>Users are recommended to upgrade to version 3.4.3, which fixes the issue.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-71183 https://vulnerability.circl.lu/vuln/ghsa-g89m-rq7v-96f2 <p>An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints.</p> <p>These endpoints fail to enforce the required data source access controls and return sensitive connection information, including data source passwords. As a result, an authenticated user without permission to access a data source can retrieve its connection details and credentials.</p> <p>Successful exploitation exposes sensitive data source information and may enable unauthorized access to the underlying databases using the disclosed credentials.</p> <p>This issue affects Apache DolphinScheduler: before 3.4.3.</p> <p>Users are recommended to upgrade to version 3.4.3, which fixes the issue.</p> <p>An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints.</p> <p>These endpoints fail to enforce the required data source access controls and return sensitive connection information, including data source passwords. As a result, an authenticated user without permission to access a data source can retrieve its connection details and credentials.</p> <p>Successful exploitation exposes sensitive data source information and may enable unauthorized access to the underlying databases using the disclosed credentials.</p> <p>This issue affects Apache DolphinScheduler: before 3.4.3.</p> <p>Users are recommended to upgrade to version 3.4.3, which fixes the issue.</p> https://vulnerability.circl.lu/vuln/ghsa-g89m-rq7v-96f2