CVE-2025-62233: Apache DolphinScheduler RPC Module Deserialization of Untrusted Data Vulnerability
Summary
CVE-2025-62233: Apache DolphinScheduler RPC module has a Deserialization of Untrusted Data vulnerability. Affects org.apache.dolphinscheduler:dolphinscheduler versions >= 3.2.0, < 3.3.1. Fixed in 3.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache DolphinScheduler is an open-source distributed scheduler that enables users to manage and schedule complex workflows. It provides a user-friendly interface and supports various data processing frameworks. However, versions 3.2.0 to 3.3.0 of the RPC module are vulnerable to a deserialization of untrusted data issue, which can be exploited by attackers to compromise the system.
Vulnerability Detail
The vulnerability arises from the ability of attackers to send specially crafted RPC requests to the Master or Worker nodes of Apache DolphinScheduler. By injecting a malicious class type into a StandardRpcRequest, an attacker can execute arbitrary code on the server, potentially leading to unauthorized access, data manipulation, or service disruption. This vulnerability is classified under CWE-502, indicating a flaw in the deserialization process that allows untrusted data to be processed.
How To Fix
Minimum fixed version
3.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider restricting access to the Master and Worker nodes to trusted IP addresses only. This can help mitigate the risk of exploitation until the upgrade is applied.
Conclusion
The deserialization of untrusted data vulnerability in Apache DolphinScheduler's RPC module poses a significant risk to users of affected versions. It is crucial to upgrade to version 3.3.1 or later to mitigate this risk. Additionally, implementing access restrictions can serve as a temporary workaround until the upgrade is completed.
See every vulnerability recorded for org.apache.dolphinscheduler:dolphinscheduler →
FAQ
The CVSS score of this vulnerability is 6.3, indicating a moderate severity level.
Versions 3.2.0 to 3.3.0 of Apache DolphinScheduler are affected by this vulnerability.
If exploited, attackers can execute arbitrary code on the server, leading to unauthorized access and potential data breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file. It provides real-time insights into potential security risks.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.dolphinscheduler:dolphinscheduler.
