Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
apache/dolphinscheduler
dev @ 0ba3a5f
96
Fixes
0
CVEs
HIGH
Peak severity
52.6%
Coverage
Highlights
Auth Bypass: 43 prior fixes. Scrutinize any change in this area.
ResourcesService.java: most-fixed (4 issues). Treat as high-risk during review.
70 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple fixes across token creation, generation, update, deletion, and listing show a persistent failure to enforce ownership and admin checks, allowing non-admin users to manipulate or view other users' tokens.
Auth Bypass / Access Control: The central permission-check service had multiple flaws where it returned true for unauthorized users, used empty authorized-resource sets, or failed to check admin status, undermining authorization across resources, environments, K8s namespaces, and worker groups.
Path Traversal: Resource file operations repeatedly lacked path canonicalization, base-directory prefix validation, or filename sanitization, allowing traversal outside intended directories and cross-tenant access.