Apache Doris vulnerabilities

6 known vulnerabilities in Apache Doris from Apache. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Apache Doris: Improper Authentication

  CVE-2026-31377Sep 23, 2026Apache

  An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints relied on client-supplied node information for authenticatio

• 8.8 High severity

  Apache Doris: Incorrect Authorization

  CVE-2026-72524Sep 14, 2026Apache

  Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1.*, from 4.0.0 through 4.0.7, and from 4.

• 9.1 Critical severity

  Apache Doris: Missing Authentication for Critical Functionality

  CVE-2026-58319Jul 14, 2026Apache

  Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster inte

• 9.8 Critical severity

  Apache Doris: Download of Code Without Integrity Check

  CVE-2024-27438Mar 21, 2024Apache

  Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary

• 9.8 Critical severity

  Apache Doris: Observable Timing Discrepancy

  CVE-2023-41313Mar 12, 2024ApacheEPSS 1.06%

  The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks. Users are recommended to upgrade to version 2.0.0 + or 1.2.8, which fixes this issue.

• 8.2 High severity

  Apache Doris: Incorrect Authorization

  CVE-2023-41314Dec 18, 2023Apache

  The api /api/snapshot and /api/get_log_file would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade to 2.0.3 to fix these issues.