H1Ei1

**Name of the Vulnerable Software and Affected Versions** Apache DolphinScheduler versions 3.2.0 through 3.4.2 **Description** An authorization flaw allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may enable users to authenticate directly to the Kubernetes API outside the application. Depending on the permissions of the disclosed credentials, such as cluster-admin or privileged service-account access, an attacker could read Kubernetes Secrets, create pods, and establish persistent access to the cluster. **Recommendations** Upgrade to version 3.4.3.

**Name of the Vulnerable Software and Affected Versions** Apache DolphinScheduler versions prior to 3.4.3 **Description** An authorization bypass allows authenticated users to modify task definitions in projects they are not authorized to access. The issue occurs at the '/dolphinscheduler/projects/{projectCode}/task-definition/{code}/with-upstream' endpoint, which fails to verify if the task definition identified by `code` belongs to the project specified by `projectCode`. An attacker can provide a `projectCode` they are authorized to access alongside a `code` from a different project to bypass restrictions and modify the target task definition and its upstream dependencies. Approximately 152,700 instances are identified globally. This flaw can compromise workflow integrity and disrupt task execution. **Recommendations** Upgrade to version 3.4.3.

**Name of the Vulnerable Software and Affected Versions** Apache DolphinScheduler versions prior to 3.4.3 **Description** An authorization bypass allows authenticated users to operate task instances in projects they are not authorized to access. This occurs through the following API endpoints: - '/dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/stop' - '/dolphinscheduler/projects/{projectCode}/task-instances/{taskInstanceId}/savepoint' **Recommendations** Upgrade to version 3.4.3.

**Name of the Vulnerable Software and Affected Versions** Apache NiFi versions 2.9.0 through 2.11.0 **Description** Connector configuration update and verification REST API methods fail to enforce authorization checks on referenced Assets and Secrets. While framework authorization is limited to write privileges on the Connector, an authenticated user with these privileges could apply Secret values from a Parameter Provider they are not authorized to read. Additionally, these methods accept Asset identifiers without verifying if the Asset belongs to the Connector being configured. This issue affects installations that implement different authorization levels across Connectors and Parameter Providers. **Recommendations** Update to version 2.12.0.