Apache DolphinScheduler fixes critical vulnerability that enables remote code execution
Take action: If you are using Apache DolphinScheduler, either lock it down to trusted networks or patch it. Ideally both, because if you keep it vulnerable someone will hack it by breaching something else first (like a simple phishing).
Learn More
A critical vulnerability has been identified in Apache DolphinScheduler, a widely-used open-source workflow orchestration platform.
The flaw, tracked as CVE-2024-43202 (CVSS score 9.8), allows remote code execution (RCE). If exploited, this vulnerability could enable attackers to execute arbitrary code remotely, potentially leading to unauthorized system access, data breaches, and further malicious activities.
The issue impacts Apache DolphinScheduler versions 3.0.0 up to, but not including, 3.2.2.
All users of the affected versions are strongly encouraged to upgrade to version 3.2.2 immediately. For users who cannot upgrade right away, the Apache Software Foundation recommends restricting network access to the affected systems.
