CVE-2025-62188: Apache DolphinScheduler Sensitive Information Disclosure Vulnerability
Summary
CVE-2025-62188: Apache DolphinScheduler vulnerable to sensitive information disclosure. Affects org.apache.dolphinscheduler:dolphinscheduler versions >= 3.1.0, < 3.2.0. Fixed in 3.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache DolphinScheduler is an open-source distributed scheduling system designed to manage and orchestrate complex workflows. It provides a user-friendly interface for scheduling tasks and monitoring their execution. However, versions 3.1.* of DolphinScheduler are vulnerable to a security issue that can lead to unauthorized access to sensitive information, including database credentials.
Vulnerability Detail
The vulnerability identified as CVE-2025-62188 is an Exposure of Sensitive Information to an Unauthorized Actor. This issue arises from improper management of sensitive data within the application, allowing unauthorized users to access critical information. The ramifications of this vulnerability can be severe, potentially leading to data breaches and unauthorized access to backend systems.
How To Fix
Minimum fixed version
3.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, users can restrict access to sensitive management endpoints by setting the following environment variable: MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus. Alternatively, you can add the following configuration to your application.yaml file:
management: endpoints: web: exposure:
include: health,metrics,prometheus
Conclusion
CVE-2025-62188 is a critical vulnerability in Apache DolphinScheduler that exposes sensitive information to unauthorized users. It is essential for users of affected versions to upgrade to version 3.2.0 or higher to mitigate the risk. For those unable to upgrade immediately, a temporary workaround is available to limit exposure.
See every vulnerability recorded for org.apache.dolphinscheduler:dolphinscheduler →
FAQ
CVE-2025-62188 is a vulnerability in Apache DolphinScheduler that allows unauthorized access to sensitive information, including database credentials.
The vulnerability affects Apache DolphinScheduler versions 3.1.*.
You can use Vulert, which monitors open-source vulnerabilities in your software using just the pom.xml file. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for CVE-2025-62188 is 7.5, indicating a high severity level.
If you cannot upgrade right away, you can implement the provided workaround to restrict access to sensitive management endpoints.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.dolphinscheduler:dolphinscheduler.
