SB20260824131 - Missing Authentication for Critical Function in Apache Doris

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260824131

SB20260824131 - Missing Authentication for Critical Function in Apache Doris

Published: August 24, 2026

Security Bulletin ID SB20260824131
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Missing Authentication for Critical Function (CVE-ID: CVE-2026-58319)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform unauthorized administrative operations.

The vulnerability exists due to improper authentication in frontend HTTP REST administrative APIs when handling requests to the FE HTTP service. A remote attacker can send crafted HTTP requests to perform unauthorized administrative operations.

This may affect cluster integrity and availability and can lead to cluster instability or denial of service.


Remediation

Install update from vendor's website.

References