Apache fixes six DolphinScheduler vulnerabilities

Apache has patched six DolphinScheduler flaws — one critical, two important and three moderate. All are fixed by upgrading to version 3.4.3, and no exploitation in the wild has been reported.

• CVE-2026-71896 (critical) lets any authenticated user list other users' account information
• CVE-2026-71895 exposes Kubernetes configuration data containing credentials
• CVE-2026-71183 returns data source connection details including passwords
• Releases before 3.4.3 are affected; CVE-2026-71895 applies to 3.2.0 and later