Apache Software Foundation Apache Doris vulnerabilities

11 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Latest Apache Software Foundation Apache Doris vulnerabilities

CVE-2026-96443 — Apache Doris: JDBC driver URL validation bypass leads to remote code execution (CVSS 6.5)
CVE-2026-31377 — Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service (CVSS 7.5)
CVE-2026-72524 — Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables (CVSS 8.8)
CVE-2026-68570 — Apache Doris: Authorization bypass leading to unauthorized data access (CVSS 6.5)
CVE-2026-58319 — Apache Doris: Improper Authentication in Frontend HTTP API (CVSS 9.1)
CVE-2024-48019 — Apache Doris: allows admin users to read arbitrary files through the REST API (CVSS 5.4)
CVE-2024-27438 — Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution (CVSS 9.8)
CVE-2024-26307 — Apache Doris: Possible race condition (CVSS 5.3)
CVE-2023-41313 — Apache Doris: Timing Attack weakness (CVSS 9.8)
CVE-2023-41314 — Apache Doris: Missing API authentication allowed DoS (CVSS 8.2)
CVE-2022-23942 — Apache Doris hardcoded cryptography initialization (CVSS 7.5)