CVE-2026-71895

Name of the Vulnerable Software and Affected Versions Apache DolphinScheduler versions 3.2.0 through 3.4.2

Description An authorization flaw allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may enable users to authenticate directly to the Kubernetes API outside the application. Depending on the permissions of the disclosed credentials, such as cluster-admin or privileged service-account access, an attacker could read Kubernetes Secrets, create pods, and establish persistent access to the cluster.

Recommendations Upgrade to version 3.4.3.