PUBLISHED
2026-09-29 12:17
MODIFIED
2026-09-29 12:17
EPSS (Prob. Exploit)
0.31%
Top 78.0%
> DESCRIPTION
The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata, depending on the fields returned by the endpoint.
This issue affects Apache DolphinScheduler: before 3.4.3.
Users are recommended to upgrade to version 3.4.3, which fixes the issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-306: Missing Authentication for Critical Function - The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource
AFFECTED PACKAGES:
Unknown / Unknown
1 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
29/09/2026 12:17
Source: NVD
📊
ENRICHISSEMENT
01/10/2026 06:01
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-306: Missing Authentication for Critical Function - The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of res...
Total des modifications: 1
Dernière mise à jour: 3 weeks ago