CVE-2026-32966: Apache DolphinScheduler DataSource API Missing Authorization Exposes Database Credentials

Vulnerability Overview

CVE-2026-32966 is a critical missing authorization vulnerability (CWE-863) in Apache DolphinScheduler's DataSource API. The root cause is an absent or improperly enforced access control check on the endpoint responsible for serving data source metadata. Any unauthenticated or low-privileged user who can reach the API can enumerate connection strings, credentials, hostnames, and database names stored within the scheduler — effectively handing attackers a map of the connected data infrastructure. The vulnerability carries a CVSS score of 9.8, reflecting the combination of no authentication requirement and high-value data exposure.

Affected Software

The vulnerability affects the Maven artifact org.apache.dolphinscheduler:dolphinscheduler-api in all releases prior to 3.4.2. Organizations running Apache DolphinScheduler in data pipeline or ETL environments — common in data engineering and analytics platforms — should treat this as an urgent remediation target. No patched release date is currently recorded, making detection and compensating controls essential.

Exploitation Status

A public proof-of-concept is available, which significantly lowers the bar for exploitation. Defenders should assume that opportunistic scanning for exposed DolphinScheduler instances is already underway. The unauthenticated nature of the vulnerable endpoint means exploitation requires no prior foothold — only network access to the API surface. Credential harvesting from the DataSource API could enable lateral movement to downstream databases, data warehouses, or cloud storage buckets. Treat any unpatched instance as compromised until proven otherwise.

How df00tech Detects It

Our detection covers this vulnerability across seven SIEM platforms: Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL).

The detection logic focuses on identifying anomalous or unauthenticated HTTP requests targeting the DolphinScheduler DataSource API endpoint. Key signals include:

• Requests to DataSource query endpoints originating from low-privilege or unauthenticated sessions
• Unusual volume of DataSource API calls from a single source IP, consistent with automated enumeration
• Access to DataSource metadata endpoints from source IPs with no prior authenticated activity in the environment
• HTTP response codes indicating successful data retrieval (2xx) from contexts that should require elevated authorization

Across all supported SIEMs, the queries are tuned to minimize false positives in environments where the API is legitimately accessed by orchestration services, while surfacing the pattern of unauthorized or anomalous enumeration that characterizes exploitation.

Recommended Action

Upgrade to Apache DolphinScheduler 3.4.2 or later as the primary remediation. As immediate compensating controls, restrict network access to the DolphinScheduler API to trusted internal networks, enforce authentication at the reverse proxy layer, and rotate any credentials stored in data sources that may have been exposed. Deploy the df00tech detection to maintain visibility during the remediation window.

The full detection page — including KQL, SPL, Elastic EQL, QRadar AQL, Sumo Logic, Chronicle YARA-L, and CrowdStrike CQL queries along with playbook guidance — is available at /detections/CVE-2026-32966.