CVE-2026-32966 — VulnIntel

CVE-2026-32966

CRITICAL

DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

StatusModified

설명

DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler.

This issue affects Apache DolphinScheduler: before 3.4.2.

Users are recommended to upgrade to version 3.4.2, which fixes the issue.

Score Summary

CVSS Score: 9.8
Version: 3.1
VPI: 98
Why this VPI (explainable, experimental)
VPI breakdown
Impact 98.00
Exploitation signal(No additional exploitation signal) ×1.00
VPI 98.00
VPI formula vpi-v1
EPSS: 0.4%
(상위 31.3%)
Attack Vector: Network
Low Complexity
No Privileges
No User Interaction
Scope Unchanged
High Confidentiality Impact
High Integrity Impact
High Availability Impact

Details

Published: 06/17/2026(last month)
Modified: 06/17/2026(last month)
Source: NVD, OSV, GITHUB_ADVISORY
Products: 1

Score Comparison by Source

Source	CVSS Version	Base Score	Severity	Vector String	Assessment Date
OSV3rd	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	06/18/2026
NVDNIST	3.1	9.8

CWE Weakness Classification

CWE-863
NVD
Secondary
CWE-863
github_advisory
Primary

References (4)

github_advisory
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-32966
github_advisory
https://github.com/apache/dolphinscheduler
github_advisory

Affected Products (1)

Impact	98.00
Exploitation signal(No additional exploitation signal)	×1.00
VPI	98.00