CVE-2026-58319CWE-306

CVE-2026-58319

Critical · published July 14, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
54.4
In the wild
Unconfirmed
What it is

Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service.

This issue affects Apache Doris versions prior to 3.1.0. Users are advised to upgrade to Apache Doris 3.1.0 or later.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00747 · 54.4th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-07-14T14:16Z
Affected products (1)
ProductVersionsFixed in
apache/doris< 3.1.03.1.0
References (2)
https://lists.apache.org/thread/cob5mxkyr1k81o8v91hox2hld6zh25b4 · [email protected]http://www.openwall.com/lists/oss-security/2026/07/14/3 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 14 JUL 09:36Z
    Apache Doris: Improper Authentication in Frontend HTTP API
    cvelistv5