CVE-2026-58319

CRITICAL 9.1

Apache Doris: Improper Authentication in Frontend HTTP API

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service. This issue affects Apache Doris versions prior to 3.1.0. Users are advised to upgrade to Apache Doris 3.1.0 or later.

CWE	CWE-306
Vendor	apache software foundation
Product	apache doris
Published	Jul 14, 2026
Last Updated	Jul 14, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache doris

Be the first to know when new critical vulnerabilities affecting apache software foundation apache doris are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Doris

2.1.0 < 3.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/cob5mxkyr1k81o8v91hox2hld6zh25b4 openwall.com: http://www.openwall.com/lists/oss-security/2026/07/14/3

Credits

Calvin Kirs, Security Researcher at SelectDB