CVE-2026-71183

*** Pendiente de traducción *** An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints.<br /> <br /> <br /> <br /> These endpoints fail to enforce the required data source access controls and return sensitive connection information, including data source passwords. As a result, an authenticated user without permission to access a data source can retrieve its connection details and credentials.<br /> <br /> <br /> <br /> Successful exploitation exposes sensitive data source information and may enable unauthorized access to the underlying databases using the disclosed credentials.<br /> <br /> <br /> <br /> This issue affects Apache DolphinScheduler: before 3.4.3.<br /> <br /> <br /> <br /> Users are recommended to upgrade to version 3.4.3, which fixes the issue.