Severity: High (CVSS 7.5)

Affected Systems: Apache Doris

Overview

Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service

A high vulnerability identified as CVE-2026-31377 has been disclosed.

An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints.



The affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access internal FE metadata interfaces, potentially exposing sensitive cluster information.



This issue affects Apache Doris: from 2.0.0 through 2.0.*, from 2.1.0 through 2.1.*, from 3.0.0 through 3.0.*, from 3.1.0 through 3.1.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Versions 1.2.x and earlier are not affected by this header-trust vulnerability.




Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.

Risk

CVSS and CISA data indicate the following:

  • Review the OpenCVE and vendor advisory for exploit conditions and impact

OpenCVE Analysis

CVSS v4.0 N/ACVSS v3.1 7.5 HighCVSS v3.0 N/ACVSS v2 N/AKEV noEPSS yesSSVC yes

  • OpenCVE title: Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service
  • Severity score: High (CVSS 7.5)
  • SSVC Automatable: yes
  • SSVC Exploitation: none
  • SSVC Technical Impact: partial
  • EPSS score: 0.00647
  • Weaknesses: CWE-287
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
Confidentiality ImpactHigh
Integrity ImpactNone
Availability ImpactNone
Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Required Action

Review the OpenCVE detail page and linked vendor advisory, then apply the vendor-provided update or mitigation for the affected product.

Prioritize systems where the affected product is internet-facing, handles authentication, or runs with elevated privileges.

Verify Updates

Confirm whether your environment uses the affected product(s): Apache Doris.

After remediation, verify the installed version against the fixed or unaffected versions listed by the vendor.

Temporary Mitigation (if patch is not available)

Use the mitigation published by the vendor. If no vendor mitigation is available, reduce exposure to the affected product, restrict access to trusted users or networks, and increase monitoring until an update can be applied.

Recommendation

  • Use OpenCVE, vendor, and source references as the source of truth for affected versions and remediation
  • Patch or mitigate affected products after confirming exposure in your environment
  • Monitor affected systems for unusual activity until remediation is complete

Support

If you require assistance, please contact our support team.

Immediate action is strongly recommended to protect your infrastructure.

Source Details

Customer Responsibility and Backups

Before applying updates, mitigations, or configuration changes, customers should take and verify current backups or snapshots of affected systems.

Customers are responsible for managing their servers, validating their own backups, testing changes, and ensuring they can restore services if an update or mitigation causes an issue.



Wednesday, September 23, 2026

« Back