PT-2026-34872 · Apache · Apache Dolphinscheduler

Published 2026-04-24 · Updated 2026-04-28 · CVE-2025-62233

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions 3.2.0 through 3.3.0

Description Deserialization of untrusted data in the RPC module allows attackers with access to Master or Worker nodes to compromise the system. This is achieved by creating a 'StandardRpcRequest', injecting a malicious class type, and sending RPC requests to the affected nodes.

Recommendations Upgrade to version 3.3.1.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-62233

GHSA-F786-9C63-8XR8

Affected Products

Apache Dolphinscheduler

References · 7

• https://osv.dev/vulnerability/GHSA-f786-9c63-8xr8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62233 · Security Note
• https://lists.apache.org/thread/79s80h51r4z5d4l2xs5xy364rmmo1bw0 · Vendor Advisory
• https://github.com/apache/dolphinscheduler · Note
• http://openwall.com/lists/oss-security/2026/04/24/2 · Note
• https://twitter.com/CVEnew/status/2048099297846059272 · Twitter Post
• https://twitter.com/oss_security/status/2048945181538365835 · Twitter Post