CVE-2026-32966 is a missing authorization check in the DataSource API of Apache DolphinScheduler, scored CVSS 9.8 by NVD. It can disclose metadata for arbitrary data sources. Versions before 3.4.2 are affected and the Apache project recommends upgrading to 3.4.2. Plan the upgrade, then review who can reach the API.
What's affected
The Apache announcement on oss-security says Apache DolphinScheduler (the dolphinscheduler-api package) before 3.4.2 is affected, and recommends version 3.4.2. Apache rates the issue moderate, while the NVD score is 9.8.
The announcement describes the flaw as a missing authorization check on the DataSource API that leads to disclosure of arbitrary data source metadata. It credits two finders by handle.
How to check if you're exposed
Find your version. The API jar carries it in the file name:
ls libs | grep dolphinscheduler-api
You can also read it from the About information in the web interface. Anything before 3.4.2 is affected.
Then ask who can log in. The flaw is an authorization gap, so every user account is a possible source of misuse.
What to do now
- Upgrade DolphinScheduler to 3.4.2 or later.
- Review which users hold accounts and remove those no longer needed.
- Check which data sources are registered and what credentials they hold, since metadata can point to sensitive systems.
- Limit network access to the API to the networks that need it.
- Treat the sister issue CVE-2026-32967 in the same release as part of the same upgrade.
Why it matters
The class is CWE-863, incorrect authorization. The API checked that a caller existed but not whether they were allowed to look at a given data source.
Workflow schedulers connect to many databases, so their data source records are a map of the environment. Leaking that metadata helps further steps. The record's KEV flag is false.
Quick check
Why do the scores differ?
The Apache project calls it moderate, NVD scores it 9.8. Use the upgrade as the answer either way.
Sources
Last reviewed: 19 October 2026.
