CVE-2026-58319
published 2026-07-14CVE-2026-58319: Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE…
PriorityP264critical9.1CVSS 3.1
AVNACLPRNUINSUCNIHAH
EPSS
0.61%
45.5th percentile
Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service.
This issue affects Apache Doris versions prior to 3.1.0. Users are advised to upgrade to Apache Doris 3.1.0 or later.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | doris | < 3.1.0 | 3.1.0 |
| apache_software_foundation | apache_doris | >= 2.1.0 < 3.1.0 | 3.1.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Doris up to 3.0.x Frontend HTTP API improper authentication (EUVD-2026-43653)
vuldb·2026-07-14·CVSS 9.1
CVE-2026-58319 [CRITICAL] Apache Doris up to 3.0.x Frontend HTTP API improper authentication (EUVD-2026-43653)
A vulnerability described as critical has been identified in Apache Doris up to 3.0.x. This issue affects some unknown processing of the component Frontend HTTP API. Executing a manipulation can lead to improper authentication.
This vulnerability is registered as CVE-2026-58319. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is recommended.
GHSA
Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication.
ghsa_unreviewed·2026-07-14
CVE-2026-58319 [CRITICAL] CWE-306 Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication.
Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service.
This issue affects Apache Doris versions prior to 3.1.0. Users are advised to upgrade to Apache Doris 3.1.0 or later.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-14
Published