Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module.
This issue affects Apache DolphinScheduler:
Version >= 3.2.0 and < 3.3.1.
Attackers who can access the Master or Worker nodes can compromise the system by creating a StandardRpcRequest, injecting a malicious class type into it, and sending RPC requests to the DolphinScheduler Master/Worker nodes.
Users are recommended to upgrade to version [3.3.1], which fixes the issue.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/79s80h51r4z5d4l2xs5xy364rmmo1bw0 | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/04/24/2 | Mailing List Third Party Advisory |
Configurations
History
27 Apr 2026, 13:45
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache dolphinscheduler
Apache |
|
| References | () https://lists.apache.org/thread/79s80h51r4z5d4l2xs5xy364rmmo1bw0 - Mailing List, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/04/24/2 - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:a:apache:dolphinscheduler:*:*:*:*:*:*:*:* |
24 Apr 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.3 |
24 Apr 2026, 12:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
24 Apr 2026, 11:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-24 11:16
Updated : 2026-04-27 13:45
NVD link : CVE-2025-62233
Mitre link : CVE-2025-62233
CVE.ORG link : CVE-2025-62233
JSON object : View
Products Affected
apache
- dolphinscheduler
CWE
CWE-502
Deserialization of Untrusted Data