Post-patch persistence: what a stolen DolphinScheduler credential still buys an attacker

The window that closing a bug does not close

DolphinScheduler 3.4.3 fixes the authorization defects behind six CVEs, including the Kubernetes credential exposure CVE-2026-71895 and the data source password disclosure CVE-2026-71183. If either flaw was exercised before the upgrade, the attacker already holds a credential that the patch does not invalidate.

Where the access survives

Apache describes what broad cluster rights allow after a kubeconfig is retrieved: reading Kubernetes Secrets, creating pods and establishing persistent access. Each of those leaves the scheduler behind. A pod the attacker created keeps running when DolphinScheduler is updated, and a Secret copied out of the cluster is unaffected by any scheduler patch.

The data source path behaves the same way. A database password retrieved through CVE-2026-71183 stays valid until someone changes it, and the connection it permits does not pass through DolphinScheduler at all.

What to check after upgrading

Compare the cluster's current objects against the expected workload, looking for pods and Secrets the platform never created. Review the data sources for logins from hosts outside the scheduler. Then rotate both credential types, which is the only step that removes the access the flaws granted.

Affected versions and fix

The affected range is DolphinScheduler before 3.4.3, with CVE-2026-71895 applying to 3.2.0 and later. Version 3.4.3 contains the fixes.

Exposure context

ZoomEye observations recorded for this topic on 2026-10-08 return 152,652 assets matching the product fingerprint app="Apache DolphinScheduler", and 0 assets for the CVE-specific filter vul.cve="CVE-2026-66084". The product figure describes hosts whose fingerprint matches the scheduler; it does not mean those hosts are running a vulnerable build or that the flaw has been confirmed on them.

Remediation

Upgrade to 3.4.3, rotate the Kubernetes and database credentials the scheduler holds, reduce their privileges, and inspect the cluster and database logs for activity that did not come from the platform.

References

Apache DolphinScheduler advisories as reported by SecurityOnline: https://securityonline.info/apache-dolphinscheduler-vulnerabilities/