CVE-2025-62188: 
Java vulnerability analysis and mitigation

CVE-2025-62188 is a sensitive information disclosure vulnerability in Apache DolphinScheduler classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). It affects all 3.1.x versions (>= 3.1.0, < 3.2.0) of the Apache DolphinScheduler workflow scheduling platform. The vulnerability allows unauthenticated remote actors to access sensitive information, including database credentials, through unprotected Spring Boot management (Actuator) endpoints. It was published on April 9, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory). This issue is noted as a re-report of CVE-2023-48796, which affected earlier versions (GitHub Advisory).

The root cause is improper restriction of Spring Boot Actuator management endpoints (CWE-200), which expose sensitive runtime configuration data — including database credentials — without requiring authentication. In Apache DolphinScheduler 3.1.x, the management.endpoints.web.exposure.include configuration is overly permissive by default, making internal endpoints such as /actuator/env or /actuator/configprops accessible to any network-reachable actor. No authentication, special privileges, or user interaction is required to exploit this vulnerability — an attacker only needs network access to the DolphinScheduler management port (GitHub Advisory). No public proof-of-concept exploit code has been identified at this time.

Successful exploitation allows unauthorized actors to retrieve sensitive configuration data, most critically database credentials, from the exposed management endpoints without any authentication. This can lead to unauthorized database access, data theft, and full compromise of the DolphinScheduler deployment and its underlying data stores. Because DolphinScheduler orchestrates data workflows and often holds credentials to multiple backend systems, credential exposure could enable lateral movement to connected databases and data pipelines (GitHub Advisory).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018–0.027%, placing it in the 8th percentile for exploitation likelihood within 30 days (GitHub Advisory). However, the low attack complexity and lack of authentication requirements make it straightforward to exploit if the management endpoints are network-accessible.

1. Reconnaissance: Identify internet-facing or network-accessible Apache DolphinScheduler instances running versions 3.1.x using tools like Shodan, Censys, or targeted port scanning against the default management port.
2. Locate management endpoints: Probe the target for exposed Spring Boot Actuator endpoints, typically at paths such as /actuator, /actuator/env, /actuator/configprops, or /actuator/beans.
3. Access sensitive data: Send an unauthenticated HTTP GET request to an exposed endpoint (e.g., GET http://<target>:<port>/actuator/env) to retrieve environment variables and configuration properties, including database credentials.
4. Extract credentials: Parse the JSON response for database connection strings, usernames, and passwords embedded in the configuration properties.
5. Leverage credentials: Use the extracted database credentials to authenticate directly to the backend database, enabling data exfiltration, modification, or further lateral movement within the environment (GitHub Advisory).

• Network: Unexpected HTTP GET requests to /actuator, /actuator/env, /actuator/configprops, /actuator/beans, or similar Spring Boot Actuator paths on the DolphinScheduler management port from external or unauthorized IP addresses.
• Logs: DolphinScheduler access logs showing repeated unauthenticated requests to /actuator/* endpoints, particularly from unfamiliar source IPs or at unusual times.
• Logs: Subsequent unauthorized authentication attempts or successful logins to backend databases using DolphinScheduler service account credentials from unexpected hosts.
• Network: Outbound connections from the DolphinScheduler host to external IPs shortly after Actuator endpoint access, potentially indicating credential use or data exfiltration.

Users should upgrade Apache DolphinScheduler to version 3.2.0 or later, which resolves this vulnerability (GitHub Advisory). For those unable to upgrade immediately, restrict the exposed management endpoints by setting the environment variable MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus. Alternatively, add the following to application.yaml:

management:
  endpoints:
    web:
      exposure:
        include: health,metrics,prometheus

Additionally, ensure management endpoints are not exposed to untrusted networks by applying firewall rules or network segmentation to restrict access to the management port.