CVE-2025-62188
Exposure of Sensitive Information in Apache DolphinScheduler 3.1.x
Publication date: 2026-04-09
Last updated on: 2026-04-17
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | dolphinscheduler | From 3.1.0 (inc) to 3.2.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthorized actors to access sensitive information, including database credentials, which could lead to a breach of confidentiality.
Exposure of sensitive information may result in non-compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive data against unauthorized access.
Organizations using affected versions of Apache DolphinScheduler should upgrade to version 3.2.0 or later to mitigate this risk and maintain compliance.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized actors to gain access to sensitive information such as database credentials.
Such exposure can lead to unauthorized access to your database and potentially compromise your data and systems.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability in Apache DolphinScheduler versions 3.1.*, users are recommended to upgrade to version 3.2.0 or later.
If immediate upgrade is not possible, a temporary workaround is to restrict the exposed management endpoints by setting the environment variable:
- MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus
Alternatively, add the following configuration to the application.yaml file to limit endpoint exposure:
- management: endpoints: web: exposure: include: health,metrics,prometheus
Can you explain this vulnerability to me?
This vulnerability is an Exposure of Sensitive Information to an Unauthorized Actor in Apache DolphinScheduler.
It allows unauthorized actors to access sensitive information, including database credentials.
The issue affects Apache DolphinScheduler versions 3.1.*.