Recommended action

Update org.apache.dolphinscheduler:dolphinscheduler-api to 3.4.2 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure affects org.apache.dolphinscheduler:dolphinscheduler-api (maven). Severity is critical. DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

AI coding agents often install or upgrade packages automatically in maven. A critical vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Recommended action

Update org.apache.dolphinscheduler:dolphinscheduler-api to 3.4.2 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure affects org.apache.dolphinscheduler:dolphinscheduler-api (maven). Severity is critical. DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

AI coding agents often install or upgrade packages automatically in maven. A critical vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software