CVE-2026-58319

CRITICAL

Apache Doris: Improper Authentication in Frontend HTTP API

Title source: cna

Description

Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service. This issue affects Apache Doris versions prior to 3.1.0. Users are advised to upgrade to Apache Doris 3.1.0 or later.

References (2)

Core 2

Core References

Mailing List

http://www.openwall.com/lists/oss-security/2026/07/14/3

Vendor Advisory vendor-advisory

https://lists.apache.org/thread/cob5mxkyr1k81o8v91hox2hld6zh25b4

Scores

CVSS v3 9.1

EPSS 0.0051

EPSS Percentile 40.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-306

Status published

Products (2)

apache/doris < 3.1.0

Apache Software Foundation/Apache Doris 2.1.0 - 3.1.0

Published Jul 14, 2026

Tracked Since Jul 14, 2026