---
id: CVE-2026-66083
title: >-
  The /datasources/unauth-datasource endpoint does not properly enforce data
  source authorization
summary: >-
  The /datasources/unauth-datasource endpoint does not properly enforce data
  source authorization. An authenticated user can invoke this endpoint to obtain
  information about data sources they are not authorized to access. This may
  expose d…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-306
vendor: apache
product: dolphinscheduler
affected:
  - dolphinscheduler < 3.4.3
patched:
  - dolphinscheduler 3.4.3
published: '2026-09-29'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T14:37:36.163'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66083'
references:
  - url: 'https://lists.apache.org/thread/b6brfom0jmy9kdt40qrn6dq0x4v2wxdr'
    label: security@apache.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/09/29/19'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
  - cve.org
epss: 0.00305
epssPercentile: 0.23148
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-29T20:15:39.129272Z'
ingestedAt: '2026-09-29T12:33:37.294Z'
---

## Overview

The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to obtain information about data sources they are not authorized to access. This may expose data source configuration and other sensitive metadata, depending on the fields returned by the endpoint.



This issue affects Apache DolphinScheduler: before 3.4.3.



Users are recommended to upgrade to version 3.4.3, which fixes the issue.

## Affected

- `dolphinscheduler < 3.4.3`

## Remediation

Upgrade past the affected range:

- `dolphinscheduler 3.4.3`