Index
Search
Search the public record. Drafts and scheduled notes are not included.
news
Apache DolphinScheduler 3.4.3 fixes six authorization flaws
On 8 October 2026 Apache disclosed six authorization CVEs in DolphinScheduler, all fixed in 3.4.3. They include kubeconfig credential exposure to non-admin users (CVE-2026-71895), data source password disclosure (CVE-2026-71183), user account disclosure (CVE-2026-71896) and three cross-project bypasses. All require an authenticated account. Not in CISA KEV. No public PoC.
Published 6h ago
CVE-2026-71183
DolphinScheduler data source authorization flaw discloses connection passwords
Info disclosure
Published 10h ago
CVE-2026-71895
DolphinScheduler lets non-admin users retrieve Kubernetes credentials
Info disclosure
Published 10h ago
CVE-2026-16528
ASUS router DDNS credentials exposed in system log
Info disclosure
Published 2d ago