An unauthenticated sensitive information exposure vulnerability in Apache DolphinScheduler, rated CVSS 7.5, poses a significant risk of credential theft and unauthorized system access.

This vulnerability is an exposure of sensitive information (CWE-200) that allows unauthenticated, remote attackers to access configuration data and database credentials via exposed management endpoints.

The ability for an unauthenticated attacker to retrieve database credentials presents a severe risk to organizational confidentiality and data integrity. Given the CVSS score of 7.5, this high-severity flaw could lead to a complete compromise of the underlying database, potentially resulting in unauthorized data exfiltration or further lateral movement within the network.

Immediate Action: Upgrade Apache DolphinScheduler to version 3.2.0 or later to ensure the management endpoints are properly restricted.

Proactive Monitoring: Review access logs for suspicious requests targeting management or metrics endpoints and monitor database access patterns for anomalous activity originating from the application server.

Compensating Controls: If an immediate upgrade is not feasible, restrict access to the vulnerable management endpoints by setting the environment variable MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE to "health,metrics,prometheus" or applying the equivalent configuration in the application.yaml file.

Public Exploit Available: Unknown.

Organizations utilizing Apache DolphinScheduler versions within the 3.1.x range must prioritize this update to prevent unauthorized access to sensitive infrastructure credentials. Apply the vendor-supplied patch immediately or implement the recommended endpoint restrictions to mitigate the risk of credential exposure.