← All advisories

Moderate severityNVD Advisory· Published Oct 28, 2022· Updated May 7, 2025

Apache DolphinScheduler exposes files without authentication

CVE-2022-26884

Description

Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.apache.dolphinscheduler:dolphinschedulerMaven	< 2.0.6	2.0.6

Affected products

2

ghsa-coords
pkg:maven/org.apache.dolphinscheduler/dolphinscheduler
Range: < 2.0.6
Apache/Dolphinschedulercpe-rescue
Range: Apache DolphinScheduler

Patches

Vulnerability mechanics

References

5

github.com/advisories/GHSA-vpgf-fgm8-gxr2ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-26884ghsaADVISORY
www.openwall.com/lists/oss-security/2022/10/28/2ghsamailing-listWEB
github.com/apache/dolphinscheduler/releases/tag/2.0.6ghsaWEB
lists.apache.org/thread/xfdst5y4hnrm2ntmc5jzrgmw2htyyb9cghsaWEB

News mentions

0

No linked articles in our index yet.