CVE-2023-51770 is an arbitrary file read vulnerability in Apache DolphinScheduler before version 3.2.1. The record rates it High at 7.5, and the Apache project rates it important. The fix is to upgrade to 3.2.1, which the project says resolves the issue.
What's affected
Apache DolphinScheduler, all versions before 3.2.1. The fixed version is 3.2.1, according to both the record and the project's announcement.
The two sources use different scales. The record gives a CVSS score of 7.5, which is High. The Apache announcement uses its own severity word, important. They describe the same issue and the same fix.
The record gives a CVSS score of 7.5 (High). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. No account is needed. No user interaction is required. Impact on confidentiality is high, on integrity none, and on availability none. The weakness class is CWE-94.
How to check if you're exposed
Find out which version of DolphinScheduler you run. The version is shown in the project's documentation for your deployment, and it is also in the release artifact name or container image tag you installed.
If you build software that embeds DolphinScheduler libraries, check your dependency tree. For a Maven project, run mvn dependency:tree and look for entries under org.apache.dolphinscheduler. Any version before 3.2.1 is affected.
What to do now
- Identify every DolphinScheduler instance and its version.
- Upgrade to 3.2.1 or later.
- Limit who can reach the API and the web UI. A scheduler should sit on an internal network, not the open internet.
- Review the host for files that the service account can read but should not, such as private keys and configuration with credentials.
- Rotate any secrets that live on the scheduler host if you cannot rule out exposure.
Why it matters
The weakness lets a caller read files from the server that they were never meant to see. A workflow scheduler often runs with broad access to the host, so readable files can include database credentials, API tokens and configuration for the jobs it controls.
The record lists CWE-94 for this CVE, which is code injection, even though the title describes an arbitrary file read. Mismatches like this are common, because the weakness label records how the flaw works while the description records the effect. We rely on the description and the project's announcement for what an attacker gains.
Because the vector shows no authentication and a network path, the sensible assumption is that any reachable instance deserves the update. The impact is confined to confidentiality, so the main risk is secrets leaking, which then enable other attacks.
Try it yourself
Walk through how a dependency inventory tells you which services and libraries carry an affected version.
Click through it at your own pace, or open it full screen.
Quick check
What is the fixed version?
3.2.1. The project recommends upgrading to it.
Why does the record say code injection?
The CWE in the record is CWE-94, but the description says arbitrary file read. We follow the description and the Apache announcement.
Sources
Last reviewed: 19 October 2026.
