DolphinScheduler 3.4.3 patch leaves stolen credentials valid

DolphinScheduler 3.4.3 fixes six CVEs, including the Kubernetes credential exposure CVE-2026-71895 and data source password disclosure CVE-2026-71183, but does not invalidate credentials already stolen. Attackers keep access to Kubernetes Secrets and databases until those credentials are rotated.

• Affected versions are below 3.4.3; CVE-2026-71895 applies to 3.2.0 and later
• ZoomEye found 152,652 hosts matching the DolphinScheduler fingerprint
• Admins must rotate kubeconfig and data source passwords after upgrading
• Attacker-created pods and copied Secrets survive the patch