Prioritizing the six DolphinScheduler CVEs: severity, exposure and patch order

The published ratings

Apache rates one of the six flaws critical, two important and three moderate. CVE-2026-71896, the critical entry, lets any authenticated user list other users' account information. CVE-2026-71895 exposes Kubernetes configuration data containing credentials, and CVE-2026-71183 returns data source connection details including passwords.

Reading the ratings against your deployment

The vendor ratings describe the flaw, not your environment. A deployment that stores production database passwords and a cluster-wide kubeconfig inside the scheduler should treat the two credential flaws as the leading items, because their impact is bounded by the privileges those credentials already carry.

Where the platform serves a single team in a single project, the cross-project trio matters less in practice than in a shared instance, and the account-listing flaw matters more if the directory holds privileged administrators.

One upgrade, six fixes

All six are corrected by the same move to DolphinScheduler 3.4.3, so the prioritization affects the follow-up work rather than the patch sequence: rotation and privilege reduction for the credential flaws, and a definition review for the tampering trio.

Affected versions and fix

Releases before 3.4.3 are affected; CVE-2026-71895 applies to 3.2.0 and later. No exploitation in the wild and no public proof-of-concept has been reported.

Exposure context

ZoomEye observations recorded for this topic on 2026-10-08 return 152,652 assets matching the product fingerprint app="Apache DolphinScheduler", and 0 assets for the CVE-specific filter vul.cve="CVE-2026-66084". The product figure describes hosts whose fingerprint matches the scheduler; it does not mean those hosts are running a vulnerable build or that the flaw has been confirmed on them.

Remediation

Upgrade to 3.4.3, rotate the exposed credential types, reduce their privileges, review account entitlements, and compare workflow definitions against the last known-good state.

References

Apache DolphinScheduler advisories as reported by SecurityOnline: https://securityonline.info/apache-dolphinscheduler-vulnerabilities/