Critical severity · published Jul 14, 2026
CVE-2026-58319
Apache Doris: Improper Authentication in Frontend HTTP API
9.1
CVSS
0.7%
EPSS
No
On KEV
Description
Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service.
This issue affects Apache Doris versions prior to 3.1.0. Users are advised to upgrade to Apache Doris 3.1.0 or later.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
Apache Doris · Apache Software Foundation
2.1.0 before 3.1.0 · source: vendor
DO
Doris · Apache
before 3.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-58319
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-58319
Mailing List
https://lists.apache.org/thread/cob5mxkyr1k81o8v91hox2hld6zh25b4
Mailing List
http://www.openwall.com/lists/oss-security/2026/07/14/3
More from Apache Doris
9.8
CVE-2024-27438
Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution
9.8
CVE-2023-41313
Apache Doris: Timing Attack weakness
8.8
CVE-2026-72524
Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables
8.2
CVE-2023-41314
Apache Doris: Missing API authentication allowed DoS
7.5
CVE-2026-31377
Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service