CVE-2026-31377: Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service
CVE-2026-31377 lets unauthenticated attackers reach the Apache Doris Frontend meta service; CVSS score is 7.5.
56
Vulnerability3 · 3 reads
CVE-2026-31377
Improper Authentication in Apache Doris Frontend Meta Service
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-31377 is an improper authentication vulnerability in the Apache Doris Frontend (FE) meta service. The flaw exists because certain internal metadata endpoints rely on client-supplied headers for authentication without properly verifying the requesting party. An unauthenticated remote attacker can exploit this to bypass access control and access sensitive cluster metadata under specific network configurations. Affected versions include major releases from 2.0.0 through 4.1.4 (excluding 1.2.x and earlier), with fixes available in 4.0.8 and 4.1.4. As of the latest advisory, there is no known public proof-of-concept or active exploitation in the wild.
What to do: Upgrade Apache Doris to version 4.0.8, 4.1.4, or a later patched release. If an upgrade is not immediately possible, ensure the Frontend meta service endpoints are not exposed to untrusted networks. Monitor for unusual access attempts to internal metadata interfaces.
| Product | Affected |
|---|---|
| Apache Doris | 2.0.0 through 2.0.*, 2.1.0 through 2.1.*, 3.0.0 through 3.0.*, 3.1.0 through 3.1.*, 4.0.0 before 4.0.8, 4.1.0 before 4.1.4 |
Estimated exposure
moderateTens of thousands of installations (10k-50k) — Estimate based on public GitHub repository statistics for the Apache Doris project and typical adoption patterns for modern open-source analytical databases.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access internal FE metadata interfaces, potentially exposing sensitive cluster information. This issue affects Apache Doris: from 2.0.0 through 2.0.*, from 2.1.0 through 2.1.*, from 3.0.0 through 3.0.*, from 3.1.0 through 3.1.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Versions 1.2.x and earlier are not affected by this header-trust vulnerability. Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue.
- Weakness
- CWE-287
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N