CVE-2026-32966: Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure

Synopsis

A missing authorization check in the Apache DolphinScheduler DataSource API allows an unauthenticated remote attacker to read data source metadata without any credentials. The vulnerability is reachable over the network and requires no privileges or user interaction to exploit. Successful exploitation exposes connection metadata for configured data sources, which may include hostnames, database names, usernames, and other configuration details. A patched-image rebuild at version 3.4.2 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable DataSource API endpoint is exposed over the network, so an attacker must be able to reach the DolphinScheduler service via HTTP/HTTPS.

• AuthenticationNot required

  The missing authorization check means no credentials of any kind are needed to call the affected API endpoint.

• Victim interactionNot required

  The attacker sends a direct request to the API; no user action or social engineering is involved.

• Attack complexityDetail

  The exploit is straightforward and condition-free: no race conditions, memory layout knowledge, or special environmental factors are required.

Blast Radius

• Reads metadata for all configured data sources, which may include hostnames, ports, database names, and usernames stored in DolphinScheduler.
• Exposes connection configuration details that an attacker can use to fingerprint backend databases and plan further attacks.
• Does not modify any data or affect service availability; impact is limited to confidentiality of data source configuration.