PT-2026-31599 · Apache · Apache Dolphinscheduler

W Aiyou · Published 2026-04-09 · Updated 2026-04-10 · CVE-2025-62188

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions 3.1.*

Description An issue exists in Apache DolphinScheduler that may allow unauthorized actors to access sensitive information, including database credentials. As a temporary workaround, users may restrict exposed management endpoints by setting the environment variable MANAGEMENT ENDPOINTS WEB EXPOSURE INCLUDE to 'health,metrics,prometheus', or by adding a configuration to the application.yaml file to include only 'health,metrics,prometheus' in the management endpoints web exposure.

Recommendations Upgrade to version 3.2.0 or later if using versions 3.1.x. As a temporary workaround, set the MANAGEMENT ENDPOINTS WEB EXPOSURE INCLUDE environment variable to 'health,metrics,prometheus'. Alternatively, configure the application.yaml file to include only 'health,metrics,prometheus' in the management endpoints web exposure.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-62188

GHSA-3CJC-VHFM-FFP2

Affected Products

Apache Dolphinscheduler

References · 8

• https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3cjc-vhfm-ffp2 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-48796 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-62188 · Security Note
• https://github.com/apache/dolphinscheduler · Note
• https://github.com/apache/dolphinscheduler/releases/tag/3.0.2 · Note
• https://twitter.com/CVEarity/status/2042557707178381553 · Twitter Post
• https://twitter.com/CVEnew/status/2042186486838411506 · Twitter Post