CVE-2026-71895: Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials

Reported by oss-security

Summary by Cyber Security News8 Oct 2026, 04:02 CEST

About this summary. This is a short, independently written summary of an article first published by oss-security. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/97

Posted by Wenjun Ruan on Oct 07 Severity: important Affected versions: - Apache DolphinScheduler 3.1.0 before 3.4.3 Description: An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the Kubernetes API outside DolphinScheduler. The...

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

🏴☠️ Thegentlemen has just published a new victim : Netcore Unbxd

Meshery: Open-source cloud-native manager for Kubernetes

NCSC-2026-0414 [1.00] [M/H] Kwetsbaarheden verholpen in GitLab

Unpatched credential leak in kubernetes/cloud-provider-gcp (auth-provider-gcp) - CVE requested (CAN-2026-2039459)

GitLab Critical Patch Release: 19.4.2, 19.3.4, 19.2.8

CVE-2026-103413: Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml