CVE-2026-31377: Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-23 · updated 2026-09-23
Weakness: CWE-287

Description

An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access internal FE metadata interfaces, potentially exposing sensitive cluster information. This issue affects Apache Doris: from 2.0.0 through 2.0.*, from 2.1.0 through 2.1.*, from 3.0.0 through 3.0.*, from 3.1.0 through 3.1.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Versions 1.2.x and earlier are not affected by this header-trust vulnerability. Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.

Affected products

Apache Software Foundation Apache Doris: from 2.0.0 before 4.0.8; from 4.1.0 before 4.1.4 — fixed in 4.0.8, 4.1.4

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Doris 4.0.8, 4.1.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-31377 or the next vulnerability affects your stack