Missing Authentication for Critical Function in Apache Doris - CVE-2026-58319
Published: August 24, 2026
Vulnerability identifier: #VU144730
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-58319
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform unauthorized administrative operations.
The vulnerability exists due to improper authentication in frontend HTTP REST administrative APIs when handling requests to the FE HTTP service. A remote attacker can send crafted HTTP requests to perform unauthorized administrative operations.
This may affect cluster integrity and availability and can lead to cluster instability or denial of service.
Affected software
Apache Doris
How to mitigate CVE-2026-58319
Install security update from vendor's website.
Apache Doris - update to 3.1.0