CVE-2026-58319 Apache Doris: Improper Authentication in Frontend HTTP API

What is CVE-2026-58319?

CVE-2026-58319 is a critical missing authorization vulnerability in Apache Doris, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service.

This issue affects Apache Doris versions prior to 3.1.0. Users are advised to upgrade to Apache Doris 3.1.0 or later.

Weakness: CWE-306

Which versions are affected by CVE-2026-58319?

It affects 1 product.

Products include Apache Doris.

How do I fix CVE-2026-58319?

No fix has been published for CVE-2026-58319 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-58319 being exploited?

There is no known exploitation of CVE-2026-58319 in the wild and no public exploit code.

Other vulnerabilities in Apache Doris

• CVE-2024-27438 Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution Critical 9.8
• CVE-2023-41313 Apache Doris: Timing Attack weakness Critical 9.8
• CVE-2023-41314 Apache Doris: Missing API authentication allowed DoS High 8.2
• CVE-2022-23942 Apache Doris hardcoded cryptography initialization High 7.5
• CVE-2024-48019 Apache Doris: allows admin users to read arbitrary files through the REST API Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qpcc-x57v-683v.