Unauthorized Kubernetes Credential Disclosure in DolphinScheduler

An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the Kubernetes API outside DolphinScheduler. The impact depends on the permissions granted to the disclosed credentials. If the kubeconfig provides cluster-admin or broadly privileged service-account access, an attacker may read Kubernetes Secrets, create pods, and establish persistent access to the cluster. This issue affects Apache DolphinScheduler: from 3.2.0 before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Apache DolphinScheduler contains an authorization flaw (CWE-862) that permits authenticated non-admin users to access kubeconfig files meant exclusively for administrator use. This vulnerability exposes Kubernetes API credentials that bypass DolphinScheduler's access controls entirely, allowing attackers to authenticate directly to Kubernetes clusters outside the application's governance framework. Organizations using DolphinScheduler for workflow orchestration in Kubernetes environments face significant risk—an attacker with basic user credentials can escalate privileges, pivot to cluster infrastructure, and potentially compromise containerized workloads depending on the permissions embedded in the exposed service account.

Casky's 283 matched skills detect the attack chain spanning TA0004 (Privilege Escalation) and TA0006 (Credential Access). Using Claude AI with extended reasoning, practitioners would identify initial lateral movement as a non-privileged user queries restricted administrative endpoints, followed by discovery of exposed credential artifacts in API responses. The skill set flags suspicious patterns: unauthorized requests to cluster configuration endpoints, retrieval of encoded kubeconfig data, and subsequent out-of-band Kubernetes API calls using those credentials. Practitioners examining their findings would see evidence of CWE-862 authorization bypass attempts, reconnaissance of Kubernetes cluster topology, and potential service account enumeration—enabling them to correlate logs and block malicious access before privilege escalation reaches cluster-admin scope.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-71895.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-71895

Casky has 283 skills that investigate the attack patterns behind CVE-2026-71895. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn