CVE-2025-62188

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-62188
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62188.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-62188
Aliases
Published
2026-04-09T09:27:13.570Z
Modified
2026-07-15T01:48:50.670013743Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.
Details

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler.

This vulnerability may allow unauthorized actors to access sensitive information, including database credentials.

This issue affects Apache DolphinScheduler versions 3.1.*.

Users are recommended to upgrade to:

  • version ≥ 3.2.0 if using 3.1.x

As a temporary workaround, users who cannot upgrade immediately may restrict the exposed management endpoints by setting the following environment variable:

MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus

Alternatively, add the following configuration to the application.yaml file:

management:
   endpoints:
     web:
        exposure:
          include: health,metrics,prometheus

This issue has been reported as CVE-2023-48796:

https://cveprocess.apache.org/cve5/CVE-2023-48796

Database specific 
{
    "cna_assigner": "apache",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "3.1.0"
                },
                {
                    "fixed": "3.2.0"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62188.json"
}
References

Affected packages

Git / github.com/apache/dolphinscheduler

Affected ranges

Type
GIT
Repo
https://github.com/apache/dolphinscheduler
Events
Introduced
ae33ba594754425a2ac72100450adffd3b5e3971
Fixed
f64b254809f21f811eaef780d489a43b490ca327
Database specific 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "3.1.0"
        },
        {
            "fixed": "3.2.0"
        }
    ],
    "cpe": "cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:*"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62188.json"