PUBLISHED
2026-04-24 11:16
MODIFIED
2026-04-24 11:16
EPSS (Prob. Exploit)
0.54%
Top 55.5%
> DESCRIPTION
Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module.
This issue affects Apache DolphinScheduler:
Version >= 3.2.0 and < 3.3.1.
Attackers who can access the Master or Worker nodes can compromise the system by creating a StandardRpcRequest, injecting a malicious class type into it, and sending RPC requests to the DolphinScheduler Master/Worker nodes.
Users are recommended to upgrade to version [3.3.1], which fixes the issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-502: Deserialization of Untrusted Data - The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
> GITHUB SECURITY ADVISORY
GHSA-f786-9c63-8xr8
MODERATE
Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerability
AFFECTED PACKAGES:
MAVEN / org.apache.dolphinscheduler:dolphinscheduler-rpc
>= 3.2.0, < 3.3.1
Fixed in: 3.3.1
MAVEN / org.apache.dolphinscheduler:dolphinscheduler
>= 3.2.0, < 3.3.1
Fixed in: 3.3.1
> HISTORIQUE DES MODIFICATIONS
Première apparition
24/04/2026 11:16
Source: NVD
📊
ENRICHISSEMENT
01/05/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-502: Deserialization of Untrusted Data - The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Total des modifications: 1
Dernière mise à jour: 6 months ago