Apache Doris
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_doris:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Doris (1e272644-b796-52ad-836f-9553581437fa) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-31377 |
vulnerable | 2026-10-13 12:29:23.211046 |
Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service
HIGH (7.5)
An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints.
The affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access internal FE metadata interfaces, potentially exposing sensitive cluster information.
This issue affects Apache Doris: from 2.0.0 through 2.0.*, from 2.1.0 through 2.1.*, from 3.0.0 through 3.0.*, from 3.1.0 through 3.1.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Versions 1.2.x and earlier are not affected by this header-trust vulnerability.
Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.
Published: 2026-09-23T09:04:56.122Z
Updated: 2026-09-23T17:08:10.651Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-96443 |
vulnerable | 2026-10-13 12:28:33.394937 |
Apache Doris: JDBC driver URL validation bypass leads to remote code execution
Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE.
Published: 2026-09-23T09:35:33.800Z
Updated: 2026-09-23T17:09:06.824Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-68570 |
vulnerable | 2026-09-16 04:33:59.371971 |
Apache Doris: Authorization bypass leading to unauthorized data access
Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information.
This issue affects Apache Doris: from 2.0.0 through 2.1.*, from 3.0.0 through 3.0.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4.
Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.
Published: 2026-09-14T10:00:20.881Z
Updated: 2026-09-14T19:38:35.447Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-72524 |
vulnerable | 2026-09-16 04:33:09.246732 |
Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables
Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to.
This issue affects Apache Doris: from 3.1.0 through 3.1.*, from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3.
Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.
Published: 2026-09-14T09:58:50.635Z
Updated: 2026-09-14T19:37:24.986Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-58319 |
vulnerable | 2026-07-29 01:03:16.764616 |
Apache Doris: Improper Authentication in Frontend HTTP API
Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service.
This issue affects Apache Doris versions prior to 3.1.0. Users are advised to upgrade to Apache Doris 3.1.0 or later.
Published: 2026-07-14T09:36:41.043Z
Updated: 2026-07-14T16:03:35.174Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-48019 |
vulnerable | 2026-06-08 06:48:13.538075 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-27438 |
vulnerable | 2026-06-08 06:31:28.863007 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-26307 |
vulnerable | 2026-06-08 06:31:26.322048 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-41314 |
vulnerable | 2026-06-08 06:11:05.918998 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-41313 |
vulnerable | 2026-06-08 06:11:05.918573 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.