Apache DolphinScheduler Vulnerability Patched — Update Immediately

A low-severity security issue in Apache DolphinScheduler has been addressed in the latest release, identified as CVE-2024-43166 and classed under CWE-276: Incorrect Default Permissions. It affects all DolphinScheduler versions prior to 3.2.2, with a strong recommendation to upgrade to version 3.3.1 to mitigate potential risks.

According to Lidong Dai, the problem stemmed from overly permissive default file and directory permissions in versions before 3.2.2, which in certain configurations could allow unauthorized users to read critical files such as workflow definitions, credentials, or logs. The fix tightens access controls, and the 3.3.1 release sets workflow and log files to 640 and configuration directories to 750, with root ownership to restrict access to the service account and administrators.

Affected users should back up, download the 3.3.1 package, install it, and restart DolphinScheduler to ensure permissions align with the updated defaults. The update underscores the importance of least-privilege principles in multi-tenant data environments.